Arcus pays out 2,234,391 USDG after integer underflow exploit
Arcus, a decentralized exchange on Robinhood Chain, paid out 2,234,391 USDG to an exploiter after a bug let a freshly created account inflate its own balance.
The trouble started at roughly 10:07 p.m. ET on November 9, 2026, when a newly created account abused flaws in how Arcus handled transfers between subaccounts.
This let the account pump up its balance well past what it had actually deposited, triggering a payout of 2,234,391 USDG.
Security firm CertiK attributes the incident to an integer underflow, a math error where a number drops below zero and wraps around into an enormous positive value.
That is the kind of math error where a number drops below zero and wraps around into an enormous positive value.
Rate limit blocked $3 million
The payouts happened across nine separate BridgeVault transfers to a wallet Arcus has since made public.
Damage could have been worse, as an on-chain rate limit engaged at about 10:10 p.m. ET and blocked an estimated $3 million in additional withdrawals.
Roughly $3 million in withdrawal requests that the rate limit had held up were reversed once a fix was deployed at 4:26 a.m. ET on November 10.
The exploiter walked away with the 2,234,391 USDG that had already cleared, and nothing more.
Arcus response and next steps
Arcus says it covered the shortfall from its company treasury and that no other users’ funds were negatively affected.
The exchange published the exploiter’s address and is working with blockchain investigators to trace the funds.
Arcus reportedly offered the exploiter a bounty in exchange for returning a substantial portion of the tokens, though whether the attacker has taken the deal remains unknown.
As of November 13, 2026, there were no reports of broader market contagion tied to the exploit.
Related
