Arcus Exploit Drains $2.23M In USDG As Bridge Limit Holds $3M

The Arcus exploit began on the night of November 9, where a newly created account on the Robinhood Chain perpetuals pulled out $2,234,391 worth of USDG that they did not have. The report about the Arcus exploit was provided by Arcus Labs on November 10. According to the exchange, they have refunded the money already from their treasury.

The timing for the start of the activity as per Arcus is roughly 10:07 PM Eastern time. This account was able to take advantage of a flaw in the exchange when moving money between the accounts of one individual. However, under certain conditions, this flaw meant that the account could report a balance that was significantly larger than its actual balance.

The "What happened" section of the Arcus incident report. Source: Arcus Labs, Arcus Incident Report: November 9, 2026.

How the Arcus exploit ran into a bridge limit

This amount was not restricted to $2.2 million alone. An additional $3 million was sought, but because of the on-chain rate limit, the transactions could not be conducted via the bridge. This rate limit came into effect three minutes after the initial withdrawal, which happened at 10:10 PM. Of the total amount of $5.2 million withdrawn, 43 percent were successful.

Based on information provided by Arcus, the held withdrawals were never paid out, and they were reversed at 5:02 AM. No other balances, positions or orders were affected in the matter. As per the report, only one account is mentioned to be related to this issue.

Reading the timeline

All the points raised by Arcus are noted by Eastern Time, and the gaps require a careful examination. The surveillance found the withdrawals at 10:15 PM. At 11:07 PM, the withdrawals on the entire platform were stopped, and this happens one hour after the initial withdrawal. The bug fix is deployed at 11:37 PM, and the addresses of the exploiter were blocked at 11:43 PM.

The summary sentence, which is found at the beginning of the report, indicates that the issue was discovered and resolved within one hour. If we take into consideration the monitoring started at 10:15 PM and ended by solving the issue at 11:37 PM, then it turns out that there are 82 minutes. All withdrawals of customers were blocked until 4:26 AM.

The response timeline in the Arcus report, all times Eastern from November 9 to November 10. Source: Arcus Labs, incident report.

Who paid for the Arcus exploit loss

The deficit was covered at 12:28 PM on November 10 through funds from the treasury of Arcus Labs. The customers using the platform were not put through any recovery process following the Arcus exploitation incident. It was the decision of the company to pay from the treasury.

The funds are out there somewhere. Arcus is cooperating with blockchain forensic experts, and they say they will work with law enforcement where necessary. They published the first address of the exploiter and asked that exchanges and service providers mark any funds received from that address.

What readers can check

The first address appears in the report, hence anyone can check it through a block explorer. The report also says that the fix has been examined by external security partners. It also states that related checks have been performed in the code base and Risk management systems for identifying suspicious activity are being improved.

The vulnerabilities in smart contracts draw most of the attention in DeFi but the Arcus exploit resulted from accounting in the exchange engine. The chain was behaving as designed. The earlier incident disclosure published on Times of Crypto Era provides an example of another recent loss within minutes.

This article reports an incident disclosure. It does not promote the usage of any platform.

Featured image: Crypto Hacking - Bitcoin by edwinchuen, licensed CC BY 2.0, via Wikimedia Commons.