Arbitrum’s Security Council has moved 74 million ARB and 8,425 ETH from an address linked to the October 29 Binance hack, without the wallet holder’s signature.
Arbitrum’s Security Council used emergency upgrade powers to move the funds. The action requires approval from nine of its twelve members, but it also highlights how users’ control over their funds can be overridden.
Arbitrum Moves $30 Million Linked To Binance Hack
Arbitrum, a Layer-2 blockchain running on Ethereum, has moved 8,425 ETH and 74 million ARB, worth around $30 million, linked to the Binance exploit. The funds were moved without the hacker’s knowledge. Arbitrum’s Security Council consists of twelve members elected by ARB token holders and has emergency powers to upgrade network contracts. However, such an action requires approval from nine of its members.
The council exercised its emergency powers for only the second time on Friday, when its shared wallet, known as the Safe, sent an Ethereum transaction that temporarily replaced the code of Arbitrum’s Inbox with a function called sendUnsignedTransactionOverride. This change allowed the Security Council to send transactions that Arbitrum assumed were from the exploiter’s address.
The council executed two transactions to move the ARB and ETH from the exploit-linked address to a holding address ending with 0DA0. The same transaction also restored the original Inbox code, according to a notice on Arbitrum’s governance forum.
“At 8:08 am HKT, 30th October 2026, the Security Council executed an emergency action to freeze 8,425 ETH and 74,559,805.2 ARB held on Arbitrum One by an address identified with today’s Binance exploit. Funds associated with the Binance exploit are frozen on Arbitrum One. No other user’s funds or applications were affected.”
Zealnyx’s Analysis
Zealnyx, a blockchain security firm, analyzed how Arbitrum froze the funds without having access to the address keys. According to the analysis, the override implementation records the target address without an alias. The funds arrived on Arbitrum as type 0x65 transactions with a blank signature field, using the exploiter’s own transaction counter because the delegate’s code does not run. The analysis stated,
“The council used powers the DAO gave it and published both actions within an hour and a half.”
Arbitrum’s Security Council has used its emergency upgrade powers previously as well, moving 30,766 ETH valued at around $71 million at the time from the KelpDAO hacker.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
