Arcus DEX flaw led to $2.23 million exploit
A flaw in Arcus DEX’s subaccount accounting let an attacker withdraw $2.23 million that had not been deposited. Arcus Labs covered the loss.
An accounting flaw in Arcus DEX’s subaccount transfer system allowed an attacker to withdraw $2.23 million that had not been deposited. Arcus Labs used treasury funds to cover the loss, while withdrawal limits blocked another $3 million in attempted withdrawals.
The exploit occurred on Nov. 9, 2026, and involved a newly created account. The attacker manipulated the balance recorded for a subaccount, making it appear that more funds were available than had been deposited. Arcus’s withdrawal system then approved transfers based on the incorrect balance.
About 2,234,391 USDG was withdrawn before Arcus suspended withdrawals at 11:07 p.m. Eastern time. The company’s incident report described the event as an accounting failure rather than a private-key compromise. Arcus found no evidence that other customers’ balances, trading positions or orders were changed.
An on-chain withdrawal limit blocked attempts to take another $3 million. Without that limit, the potential loss could have reached about $5.23 million.
Arcus fixed the vulnerability about 30 minutes after suspending withdrawals. Withdrawals resumed at 4:26 a.m. on Nov. 10. The company blocked the attacker’s addresses from trading, transferring and withdrawing funds, and reviewed the relevant code with security partners.
Arcus Labs covered the full $2,234,391 shortfall with company funds. The company also shared the attacker’s wallet address and asked cryptocurrency exchanges and other service providers to flag funds linked to it.
Reports have circulated about a proposed offer under which the attacker would keep 10% of the funds in exchange for returning 90% by Nov. 13. Arcus has not confirmed the offer in its official incident report.
Reviewed and fact-checked by Alex Panasenko on November 11.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
