On October 30, 2026, Arbitrum's 12-member Security Council executed emergency powers to move $30 million in ETH and ARB tokens from an address linked to a $6.3 billion Binance hot wallet exploit without requiring the attacker's private key. Nine signers authorized code overrides in Arbitrum's Inbox contract to redirect the assets to a DAO holding address. The intervention highlights tension surrounding network upgrade authority, as the frozen funds now await a formal ArbitrumDAO governance vote to determine their final allocation.
Technical execution of the fund transfer
- ▪The Security Council temporarily modified Arbitrum's Inbox contract using a function called sendUnsignedTransactionOverride to process transactions as if sent by the Binance exploiter's address, before restoring the original contract code
- ▪Arbitrum's Security Council initiated the transfer of Binance exploit funds by calling the UpgradeExecutor contract through its Safe wallet in Ethereum block 26301886
Binance hot wallet exploit
- ▪Binance reported total losses of approximately $6.3 billion following the October 30, 2026 exploit of its hot wallets
- ▪Binance's hot wallets were drained
Previous KelpDAO fund recovery and legal dispute
- ▪Arbitrum's Security Council previously used its emergency powers in April 2026 to transfer over 30,765 ETH from an address held by the KelpDAO exploiter on Arbitrum One
- ▪Following the Security Council's April 2026 KelpDAO recovery, an ArbitrumDAO vote was delayed when families holding unpaid terrorism judgments against North Korea attempted to claim the ETH recovered from the KelpDAO exploiter in federal court
Governance and powers of the Security Council
- ▪Steven Goldfeder, co-founder and CEO of Offchain Labs, stated in July 2026 that Arbitrum's emergency powers belong to an external, broadly elected council rather than individual developers
- ▪Arbitrum's Security Council is a 12-member body elected by ARB token holders that requires nine signers to execute emergency protocol updates
- ▪Security firm Zealynx noted that blockchain rules requiring a private key to authorize transfers hold true only up to whoever controls the protocol's upgrade path
Story comments
Loading comments…