Arbitrum’s Security Council transferred approximately $30 million worth of digital assets from a wallet associated with the Binance breach last Friday, accomplishing the move entirely without the attacker’s authorization.
Valued at current market rates, that sum amounts to roughly $30 million, which is a tiny fraction compared to the estimated $6.3 billion stolen from Binance.
Arbitrum functions as a layer-2 scaling network built on top of Ethereum designed to lower transaction costs, and it safeguards billions of dollars in user assets. On any blockchain platform, wallet balances typically shift only when the corresponding private key—a confidential string known exclusively to the owner—authentically approves the transfer.
The Security Council comprises a 12-member committee chosen by ARB token holders, possessing emergency privileges to modify network smart contracts provided that nine members reach a consensus.
The council exercised these exceptional privileges in an atypical manner last Friday. Utilizing their multisig wallet, known as a Safe, which mandates nine authorizations, the committee executed a single Ethereum transaction that temporarily altered the logic of the Arbitrum Inbox, the contract responsible for relaying messages from Ethereum to Arbitrum.
This substitute code introduced a method designated as sendUnsignedTransactionOverride, enabling the council to dispatch operations that the Arbitrum network processed as if they originated directly from the exploiter’s address.
As outlined in the council’s announcement published on the Arbitrum governance forum, a pair of such transactions transferred the ARB tokens and ether into a secure holding address terminating in 0DA0, while the original Inbox logic was reinstated within that exact same transaction.
The notification stated that “No other user’s funds or applications were affected.” It further noted that the recovered assets “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.”
Blockchain security organization Zealynx tracked the transfers, pointing out that the assets landed on Arbitrum roughly 10 minutes following the Ethereum transaction as type 0x65 transfers featuring empty signature fields, and they leveraged the attacker address’s unique nonce counter.
The firm remarked that the council “used powers the DAO gave it and published both actions within an hour and a half,” and added that the foundational rule assuming funds move strictly via private key signatures remains valid only “up to whoever controls the upgrade path.”
Nevertheless, that constitutes a substantial caveat for an ecosystem promoting itself as decentralized, implying that whoever manages the upgrade mechanism possesses the ability to compel any Arbitrum address to expend funds.
The council has previously executed similar interventions. Back in April, it relocated 30,766 ETH, valued at approximately $71 million at the time, originating from the KelpDAO exploiter subsequent to law enforcement identifying the perpetrator.
Extracting those funds out of the custodial holding address required several weeks. Relatives holding outstanding terrorism-related judgments against North Korea attempted to lay claim to the assets, and a federal judge in Manhattan was forced to adjust a freezing injunction prior to the DAO being able to hold a vote approving the transfer to Aave.
Originally published at https://www.coindesk.com/tech/2026/11/03/arbitrum-s-council-moved-usd30-million-of-binance-hack-funds-without-the-hacker-s-key.
