Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key
Arbitrum's Security Council moved approximately $30 million in cryptocurrency from an address linked to the Binance hack without the attacker's signature.
The council executed the move last Friday using emergency powers that require approval from nine of its 12 members. This action highlights how these powers can override users' control of their funds on the network, which processes transactions on top of Ethereum to make them cheaper.
The recovered assets, valued at roughly $30 million compared to the $6.3 billion stolen from Binance, are now in a holding address ending in 0DA0. The funds can only be moved through an ArbitrumDAO governance vote, a process that previously encountered legal complications.
Emergency Protocol Used
The council's Safe, a shared wallet requiring nine signatures, sent a single Ethereum transaction that temporarily modified Arbitrum's Inbox contract. The replacement code added a function called sendUnsignedTransactionOverride, allowing the council to execute transactions treated as coming from the exploiter's address.
Previous Recovery Set Precedent
This isn't the first time the council has taken such action. In April, it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker. However, releasing those funds took weeks due to legal challenges from families holding unpaid terrorism judgments against North Korea.
Security firm Zealynx confirmed the transactions, noting they arrived on Arbitrum about 10 minutes after the Ethereum transaction with blank signature fields, using the exploiter address's own transaction counter. The firm emphasized that while the council used powers granted by the DAO, this demonstrates that whoever controls the upgrade path can make any address on Arbitrum spend.
Related
