Arcus Recovers from $234,000 Accounting Loophole Exploit on November 10

The decentralized trading platform Arcus has officially disclosed a security incident involving an accounting loophole that occurred on November 10, 2026. The vulnerability allowed an unauthorized user to withdraw assets that did not belong to them, resulting in a loss of approximately 234,000 USDG. Despite the breach, the platform managed to stabilize operations within an hour, ensuring that user balances remained unaffected and that the shortfall was fully covered by the company treasury.

Mechanism of the Exploit and Rapid Response

The incident began at 11:07 AM Beijing time when a newly registered account identified a flaw in how Arcus processed transfers between user sub-accounts. By manipulating this internal accounting logic, the attacker was able to record a balance significantly higher than their actual holdings.

• The attacker requested a withdrawal based on the inflated balance.
• Approximately 234,000 USDG was successfully moved on-chain.
• An additional 1 million USDG in withdrawal attempts was thwarted.

The platform’s security infrastructure, specifically the cross-chain bridge’s rate limit, played a critical role in preventing a larger catastrophe. This automated system intercepted the subsequent high-value requests, which were later canceled by the Arcus technical team once the loophole was identified and patched.

Treasury Compensation and Ongoing Investigation

Following the detection of the anomaly, Arcus Labs acted to maintain market confidence by deploying funds from the company’s internal reserves to cover the deficit. This decision ensured that liquidity providers and retail traders did not face any haircuts or service interruptions. Currently, all trading and withdrawal functions are operating under normal parameters.

Arcus Labs has fully compensated the shortfall from the company treasury and is cooperating with blockchain investigators to track the funds and has published the attacker's initial address.

The protocol is now working alongside on-chain forensic specialists to trace the movement of the stolen assets across the blockchain. By publishing the attacker’s initial wallet address, Arcus aims to facilitate transparency and assist decentralized finance (DeFi) security protocols in blacklisting the associated entities.

In conclusion, while the November 10 exploit highlighted a temporary weakness in sub-account synchronization, the swift intervention by Arcus Labs prevented a systemic failure. The event underscores the importance of rate-limiting mechanisms in decentralized ecosystems as a primary defense against rapid liquidity depletion.