Arcus covers $2,234,391 withdrawal exploit after subaccount bug

On November 9, 2026, Arcus exchange identified an accounting vulnerability in its subaccount system that allowed an attacker to withdraw $2,234,391 USDG against a balance it did not own. According to the exchange's incident report, the company treasury covered the resulting shortfall, and normal trading and withdrawals have since resumed.

The exploit involved transfers between subaccounts belonging to the same wallet. Under unspecified conditions, Arcus recorded a balance far larger than the account actually held, then accepted withdrawal requests against that inflated amount. The exchange confirmed that only a single account was affected and that other users' balances, positions, and orders remained unchanged.

The bridge's on-chain rate limit prevented another $3 million in requested withdrawals from being processed. Arcus stated that these blocked requests were never paid out and were later reversed. The exchange accounted for this separately from the funds that successfully left the platform.

Timeline of Response

Arcus detected the first exploit activity at approximately 10:07 p.m. ET on November 9. Its timeline shows the bridge rate limit capped payouts at 10:10 p.m., before monitoring flagged the suspicious withdrawals at 10:15 p.m. The team began investigating immediately.

At 11:07 p.m., Arcus paused withdrawals across the platform and updated its status page. The team deployed the fix at 11:37 p.m. and blocked the exploiter's addresses from trading, transferring, and withdrawing at 11:43 p.m. These interventions were implemented in sequence.

Withdrawals reopened at 4:26 a.m. ET on November 10. Arcus reversed the exploiter's pending withdrawals at 5:02 a.m., and the company treasury covered the shortfall at 12:28 p.m. Notably, withdrawals reopened before the outstanding requests were reversed or the reimbursement was recorded.

The team detected and fixed the bug within one hour.

Technical Vulnerability

Arcus's subaccount system allows a wallet to have up to 10 separate accounts, each with its own collateral balance, rate-limit pools, and volume credit. Internal transfers move collateral between different indexes under the same master wallet address, using self-signed EIP-712 typed-data signatures for authorization.

The transfer API is asynchronous, with a 202 Accepted response indicating a queued request. These internal transfers never settle on-chain, as funds remain in custody while moving between indexes. However, in this incident, an incorrect internal balance supported withdrawal requests that successfully reached the blockchain.

Arcus's perpetuals architecture includes an off-chain order book, an appchain for consensus, and an EVM public rootchain for settlement. The appchain validators check state transitions and verify signatures, while the Bridge Vault handles withdrawals. The report doesn't explain how the incorrect balance passed through these components.

Aftermath and Recovery

Following the incident, Arcus stated that security partners reviewed the fix and related codebase checks. The exchange is continuing to improve systems for detecting and mitigating suspicious activity. Blockchain investigators are now helping track the withdrawn funds, and Arcus will coordinate with law enforcement as appropriate.

The company treasury absorbed the entire $2,234,391 shortfall without reducing other users' balances. The exchange has not provided a total recovery amount or timetable for a fuller technical disclosure. No emergency settlement mechanism was activated during the incident.