Arbitrum Council Moves Binance Exploit Funds Without a Signature

At 00:08:35 UTC on October 30, 2026, the Arbitrum Security Council executed an emergency response to funds linked to the Binance exploit. The council froze 8,425 ETH and 74,559,805.2 ARB by transferring them to a holding address.

The mechanism allowed the council to act as the exploiter's address without obtaining that address's signature. It temporarily replaced the implementation of Arbitrum's Ethereum Inbox contract, sent cross-chain messages impersonating the target, and then restored the original implementation.

The council’s notice states that no other user’s funds or applications were affected by the intervention.

Technical Mechanism

The council utilized a custom function called sendUnsignedTransactionOverride to execute the transfer. This function imitated a standard cross-chain transaction while allowing the transaction sender to be impersonated.

Ordinary cross-chain transactions rely on a signature to recover the sender's address from the transaction metadata. The council's override bypassed this step, constructing an ArbitrumUnsignedTx with the sender set to the target address directly from the message metadata.

The Ethereum transaction receipt confirms the successful execution of this atomic upgrade action. It records four implementation-change events alternating between two addresses, all within a single transaction, and verifies the $ARB transfer to the holding address.

The $ARB leg of the transfer was executed on Arbitrum One in transaction 0x75e81a…eeedb6. The transaction called the token's transfer function with the holding address as the recipient, emitting a Transfer event from the exploiter-linked address to 0x0000000000000000000000000000000000000DA0.

Governance and Authority

The authority for this action stems from Arbitrum’s constitution, which assigns chain-owner privileges to both the DAO and the Security Council. These privileges include changes to core protocol code and upgrades to associated Ethereum contracts.

The Security Council consists of 12 multisig signers. Emergency action requires approval from nine members and can execute without a delay, a route restricted to a true security emergency that threatens a governed chain's integrity.

The council’s notice describes the affected funds, the override mechanism, the execution transaction, and the requirement for a later release vote. It attributes the target address to the Binance exploit.

This chain-level operation was separate from Aave’s market freeze after the Binance breach. Aave blocked new supply and borrowing while preserving repayments, withdrawals, and liquidations, leaving frozen reserves unable to accept added collateral.

Aave’s responders chose a freeze because guardians could reverse it; lowering caps would have required a governance vote to restore them. They left the Horizon market open because its permissioned collateral could not be used by the exploiter.

Release Process

Movement from the holding address requires an ArbitrumDAO governance vote coordinated with relevant parties. The completed containment transaction verifies that the $ARB moved into custody; the notice leaves subsequent distribution to that separate process.

The ordinary proposal framework requires a proposer with at least 1,000,000 delegated votable tokens. After submission, the constitution provides a three-day period before the voting snapshot and voting begin, with a normal voting duration of 14 days.

Execution delays then depend on the proposal’s route. The constitution provides a three-day waiting period for treasury actions and eight days for an L2-to-L1 message, with a cross-chain route also waiting for that message to finalize on Ethereum.

The document says these intervals protect the ordering of withdrawals relative to governance changes. Any release proposal must identify its actual execution steps before a completion date can be established.