Arbitrum Council Moved $30 Million of Binance Hack Funds Without the Hacker’s Key

Arbitrum’s Security Council moved about 30 million dollars in cryptocurrency from an address linked to the Binance hack without the attacker’s signature, using emergency powers that let a small elected group rewrite a core network contract. The operation, carried out on Friday October 30 and reported by CoinDesk on November 3, transferred more than 8,425 ether and 74 million ARB tokens out of an address tied to the exploit, and it has reopened one of the oldest arguments in decentralised finance: who really controls the money when the code says one thing and the governance says another.

The amount is small beside the roughly 6.3 billion dollars taken from Binance on October 29, the largest exchange theft on record. But the mechanism is what matters. On any blockchain, a wallet’s funds are supposed to move only when its private key, a secret number known only to the owner, signs the transfer. The Security Council moved funds without that signature, by temporarily replacing the code of a contract that carries messages from Ethereum into Arbitrum, adding a function that let it send transactions the network treated as if they had come from the exploiter’s address. The original code was restored within the same transaction, and the recovered assets now sit in a holding address that can only be emptied by a vote of ArbitrumDAO, the network’s token-holder governance body.

How the council moved funds it had no key for

Arbitrum is a layer-2 network that runs on top of Ethereum, processing transactions more cheaply and quickly than Ethereum itself while settling back to it for security. Its Security Council is a twelve-member group elected by holders of the ARB token, with emergency powers to upgrade the network’s contracts when nine of its twelve members agree. Those powers exist for genuine emergencies: a critical bug, a live exploit, a threat to user funds that cannot wait for the weeks a full governance vote would take. The council’s shared wallet, a Safe that requires nine signatures, is the instrument through which those powers are exercised.

On Friday, the council’s Safe sent a single Ethereum transaction that temporarily swapped the code of Arbitrum’s Inbox, the contract that carries messages from Ethereum into Arbitrum. The replacement code added a function called sendUnsignedTransactionOverride, which allowed the council to submit transactions that Arbitrum processed as though they originated from the exploiter’s address, despite the absence of the attacker’s signature. Two such transactions moved the ether and the ARB tokens to a holding address ending in 0DA0, and the original Inbox code was restored in the same Ethereum transaction, so the override existed only for the duration of that one transaction.

Zealynx, which traced the operation, said the funds arrived on Arbitrum about ten minutes after the Ethereum transaction, as type 0x65 transactions with blank signature fields, using the exploiter address’s own transaction counter. The technical detail is telling: the transactions were not forgeries in the usual sense, because they were executed by the network’s own machinery under code the council had temporarily installed. They were, in effect, legitimate transactions under rules the council had briefly rewritten. That is precisely why the episode is so revealing. The security model of a blockchain rests on the assumption that an address moves only when its key signs. The council demonstrated that on Arbitrum, that assumption holds only up to whoever controls the upgrade path.

Why only $30 million, and why it still matters

Set against 6.3 billion dollars stolen, 30 million dollars is a rounding error, and it would be a mistake to present the Arbitrum operation as a major dent in the hacker’s haul. Most of the stolen funds were in assets and on chains where no equivalent intervention was available, and roughly 3 billion dollars of the total has been frozen by other means, principally stablecoin issuers Tether and Circle freezing USDT and USDC at the contract level. The Arbitrum recovery is a footnote in the financial accounting of the hack.

Its significance lies elsewhere. First, it is the second time this year the council has used these powers, which turns a one-off emergency measure into a pattern. In April, the council moved 30,766 ether, then worth about 71 million dollars, from the KelpDAO exploiter after law enforcement identified the attacker. Two uses in seven months suggests the emergency powers are becoming a standing tool of post-hack recovery, not a break-glass-only exception. Second, the operation shows that layer-2 networks, which hold billions of dollars in user deposits, have a governance backdoor that does not exist on Ethereum itself, where no council can rewrite a wallet’s permissions. Users who treat Arbitrum as equivalent to Ethereum in security terms are missing a real difference.

Third, the recovery exposes the legal tangle that follows any frozen-fund intervention. Getting the April KelpDAO ether out of its holding address took weeks, because families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send the funds to Aave, the lending protocol affected by that exploit. The Binance-linked funds now sitting in the 0DA0 holding address face a similar future: a governance vote, coordination with relevant parties, and the possibility of competing legal claims, especially given the FBI’s attribution of the Binance hack to North Korea’s TraderTraitor group. Recovery, in other words, is not the same as return. The funds are secured, but they are not yet restored to anyone, and the path from holding address to rightful owner runs through governance and potentially through courts.

The decentralisation debate, stated plainly

Critics of the intervention argue that it proves Arbitrum is not truly decentralised. If nine of twelve council members can temporarily rewrite a core contract and move any address’s funds, then the network’s security ultimately rests on the trustworthiness of those twelve people, not on cryptography. That is a centralised trust assumption wearing decentralised clothing, and it is the same criticism levelled at many layer-2 networks and decentralised finance protocols, which commonly retain upgrade keys, admin controls or multisignature wallets held by small groups. The defence is that these powers are transparent, time-limited, elected by token holders, and used only in emergencies, which distinguishes them from the opaque control of a traditional company. Both arguments have force, and the honest position is that Arbitrum sits somewhere on a spectrum: more decentralised than a centralised exchange, less decentralised than Ethereum itself, with its exact position depending on how much weight one gives to the existence of the power versus the restraint shown in its use.

Supporters of the council’s action make a practical case that is hard to dismiss. Without the intervention, 30 million dollars in stolen funds would have remained under the attacker’s control, free to be laundered onward. The council acted within about a day of the hack, published its actions promptly, touched nothing else, and placed the funds under governance control rather than its own. The alternative, strict non-intervention, would have preserved a principle at the cost of letting a thief keep the proceeds. For a network whose users include ordinary holders and lending protocols, that trade-off is not abstract. It is also worth noting that the intervention was only possible because the stolen funds were sitting on Arbitrum itself. Funds that had already been bridged elsewhere, swapped, or mixed were beyond the council’s reach, which is a natural limit on the power, not a designed one.

What remains unclear and what happens next

Several points remain unresolved, and they should be stated plainly rather than smoothed over. First, the reports do not fully detail how the exploiter’s address came to hold the ether and ARB, or the exact chain of events by which stolen Binance funds arrived on Arbitrum. CoinDesk reported that the address was tied to the exploit, and Zealynx traced the council’s transactions, but the public record does not yet give a complete provenance for the 8,425 ether and 74 million ARB. Second, it is not yet clear when, or to whom, the ArbitrumDAO governance vote will release the funds, or whether legal claims will delay that vote as they did after the KelpDAO recovery. Third, the council has not published a general policy governing future uses of these powers, so users cannot know in advance what threshold of crime, evidence or urgency would trigger another intervention.

What exactly did Arbitrum’s Security Council do?

The council used emergency upgrade powers, approved by nine of its twelve members, to temporarily replace the code of Arbitrum’s Inbox contract with a version containing a sendUnsignedTransactionOverride function. That let it send transactions Arbitrum treated as coming from the exploiter’s address, moving 8,425 ether and 74 million ARB to a holding address, before restoring the original code in the same transaction.

Who controls the recovered funds now?

The funds sit in a holding address ending in 0DA0 and can only be moved by an ArbitrumDAO governance vote coordinated with relevant parties, according to the council’s notice. The council itself cannot spend them unilaterally, but the timeline and recipient of any release vote have not yet been announced.

Has Arbitrum done this before?

Yes. In April the council moved 30,766 ether, then worth about 71 million dollars, from the KelpDAO exploiter after law enforcement identified the attacker. Releasing those funds took weeks because families holding unpaid terrorism judgments against North Korea tried to claim them, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send the funds to Aave.

Does this mean Arbitrum is not decentralised?

It means Arbitrum’s decentralisation has a real limit: whoever controls the upgrade path can make any address on the network spend, as Zealynx put it. The council is elected by ARB holders, its powers require nine of twelve signatures, and its actions are published, which distinguishes it from opaque centralised control, but the power itself is a centralising feature that users should understand.

Source: CoinDesk

Related reading on MM Crypto Analysis Web

• Stolen Binance Funds Boost DeFi Protocol Revenue
• Polymarket Halted Trading After a Hijacked DebugBear Script Drained $2.73 Million
• DeFi Yields Swung Violently in the Week of October 25 to November 1

More in DeFi on MM Crypto Analysis Web.