Arbitrum Security Council Moved Hackers' 74.6 Million ARB to a Holding Address

Nine Signatures Moved the Hackers' Tokens

About 8,425 ETH and 74.6 million Arbitrum (ARB) taken in the Binance breach now sit in a holding address under Arbitrum DAO control, placed there on Oct. 30 by the network's Security Council without the hackers' private keys ever entering the picture. The council acted one day after the theft of $6.43 billion from Binance, which blockchain analytics firm Elliptic calls the largest hack on record. The dollars moved first. Tether froze the hackers' USDT 37 minutes after it reached their main wallet, and Circle locked all $823 million in stolen USDC minutes later, so both stablecoin balances still sit in the hackers' wallet address, blocked at the contract level. The network could not copy that method: Arbitrum, an Ethereum layer-2, has no blacklist function to invoke. What it has instead is a 12-person Security Council, elected by the network's token holders, and a rule from its DAO constitution: the council may upgrade anything “with no delay in order to respond to a security emergency.” Nine of the twelve signatures are enough. On the evening of Oct. 29, the council used that power to briefly replace the software that relays transactions into the network, then sent two transactions in the hackers' name through the substitute relay, sweeping 8,425 ETH and 74.6 million Arbitrum (ARB), the network's governance token, into the holding address. Our earlier report on the frozen 74.6 million ARB traced both transfers on-chain the same day. Unlike an issuer blacklist, which locks a balance in place, this operation physically relocated the assets, so no move by the hackers, including any rotation of their private keys, could recover them. The response to this theft has also been unusually effective in aggregate: Elliptic's tally puts roughly 44% of the $6.43 billion haul as frozen or seized, against about 3% after the Bybit theft last year. What nobody has stopped is the bitcoin: none of the 18,270 stolen BTC has been frozen, and neither has the ether the hackers hold on Ethereum mainnet.

A Precedent From the KelpDAO Case

The Oct. 30 operation has one direct precedent. In April, the same council used the relay-replacement power against the KelpDAO exploiter, and getting that ether released took until June 15. The holdup was legal, not technical: families holding court judgments against North Korea served a restraining notice on the frozen assets, and a federal court had to clear the transfer before token holders voted to route the funds to Aave. The stablecoin side of the response, by contrast, came together within the first hour after the theft. Freezing the Arbitrum-based assets in the April case drew criticism at the time, worth remembering now that the council has acted this way twice: the same power that stops thieves can be contested by the users it governs. The mechanism is also spreading. Robinhood Chain, launched in July on Arbitrum's tech stack and now holding about $2.24 billion, gives an equivalent freeze power to a single Robinhood wallet that needs seven of eight signatures and imposes no waiting period. Public layer-2 safeguard trackers report that 79 of the 83 networks they monitor give users no window to withdraw before an upgrade takes effect. Issuer-side freezes run on different code but reach the same result. Tether's contract can destroy a blacklisted balance and reissue the tokens, a function the company says has returned about $1.2 billion from past thefts, while Circle's contract carries no such function. Circle has written that it freezes funds only when legally compelled through lawful process, though it added an exception in May for urgent law-enforcement requests made before any court order. Bitcoin sits outside all of this. No issuer, council or court holds a switch over it, which is why the 18,270 stolen BTC remains beyond reach, and why the question Arbitrum's action revives is when, if ever, anyone other than a key holder should be able to move a coin.

What the On-Chain Record Shows Now

The council's own emergency-action notice on the Arbitrum (ARB) forum, filed Oct. 30, is the post-mortem for the operation: it records the relay replacement and the two transfers, and on-chain data confirms the destination has not changed since. The loss of control traces to the relay-replacement power, not to any compromise of the hackers' keys, so the tokens come back, if they come back, through a DAO release process like the one that took six weeks in the KelpDAO case. A scheduled unlock of 93.14 million ARB on Nov. 15 will add to circulating supply while the stolen 74.6 million sits locked. As of Nov. 5, on-chain records place the 8,425 ETH and 74.6 million ARB at the holding address, the last point at which they have been seen.