Arbitrum (ARB) Security Council Froze 74.6 Million ARB From Binance-Exploit Address

An Address Emptied Without Its Key

Arbitrum's Security Council emptied an address of 74,559,805.2 Arbitrum (ARB) and about 8,426 ETH on Friday, October 30, without ever holding the address's private key. The council's emergency notice, posted on its governance forum, says the address was “identified with today’s Binance exploit,” the breach that drained the exchange's hot wallets hours earlier and that the exchange has put at a loss of about $6.3 billion. The transfers left the address at 8:08 a.m. Hong Kong time, according to the notice, and both assets went to a single holding destination rather than back to any victim or exchange account. The notice gave no schedule for returning or redistributing either asset. No other user's funds or applications were affected, the notice adds. The Arbitrum (ARB) price has slipped about 4.8% over the past 24 hours, a market move separate from the freeze itself. The council acted on its own authority, without a DAO vote first, under the emergency powers its members hold for such situations. The action has a direct precedent. In April, the same council moved more than 30,765 ETH that the KelpDAO exploiter held on Arbitrum (ARB) One, under an emergency notice published at the time. The April episode followed the same pattern: on-chain seizure first, public notice after, the disposal question left open. Steven Goldfeder, co-founder and CEO of Offchain Labs, which develops Arbitrum, said in July that the council's role in the April freeze was by design: the power sat with an “external entity” that is “broadly elected,” and, in his words, “it wasn’t like me that had the power to do that.”

Nine Signers, One Ethereum Transaction

A walkthrough posted Monday, November 2, by the researcher Zealynx reconstructs how the council moved assets it did not control. The council's Safe, which currently requires nine of its 12 signers, called Arbitrum's UpgradeExecutor in a single Ethereum transaction in block 26301886, according to the walkthrough. UpgradeExecutor is the contract that governs how Arbitrum One's code can be changed; the council briefly ran the chain's Inbox on override code that logs the target wallet address, unaliased, as the message's sender, then restored the original code once the message was in. That sequence ran twice, Arbitrum (ARB) first and ETH second. Both messages executed on Arbitrum One, the project's layer 2 network, 9 minutes and 45 seconds after the Ethereum transaction. They went out as type 0x65 transactions with zeroed signature fields and consumed the address's nonces 2 and 3. The first sent the ARB to a holding address ending in 0DA0; the second moved 8,425.99768 ETH to the same place. The two nonces matter: because the messages carried the address's own sequence numbers, the transfers look to any observer like ordinary outgoing payments from the holder. Nothing in the token's logs gives the move away: the ARB contract and indexers record a plain transfer that the holder appears to have made. On Arbitrum One, what sets the transaction apart is its 0x65 type and its blank signature. Zealynx wrote that no bug is visible in any of this: the council used powers the DAO granted it and published both actions within an hour and a half. The broader point is aimed at builders. When a specification promises that only a key can move a wallet, that promise holds only up to whoever controls the upgrade path, and on Arbitrum One both the council's emergency Safe and the DAO's timelock on Ethereum hold that path.

The Disposal Waits on ArbitrumDAO

The episode reads as the council using powers the DAO granted it, and it leaves the hardest decision unresolved. The notice states the frozen funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties,” and no such vote has been recorded since the freeze. What would settle the matter is token holders disposing of the 74.56 million ARB and about 8,426 ETH; the record so far fixes neither a date nor a mechanism beyond that vote. The freeze also reaches the wider Arbitrum ecosystem during a stretch of scheduled supply pressure, just weeks before a planned unlock. The supply side of Arbitrum technical analysis now carries two overhangs: the frozen 74.56 million ARB awaiting the DAO, and the 93.14 million scheduled for November 15. Whether the DAO moves on either stack quickly, the council's notice does not say.