Add as a preferred source on GoogleArcus Loses $2.23M in USDG Through Accounting Flaw, Covers Shortfall
A newly created account inflated its recorded balance through subaccount transfers. Arcus patched the flaw and resumed withdrawals.
Arcus Labs covered a $2.23 million shortfall after an accounting flaw let a newly created account withdraw Global Dollar (USDG) from its Robinhood Chain trading platform.
The account exploited a flaw in transfers between its own subaccounts, causing Arcus to record a balance larger than the account held. It withdrew 2,234,391 USDG on-chain. A bridge limit blocked another $3 million in withdrawal requests; those requests were never paid out and were later reversed.
The first exploit activity began around 10:07 p.m. ET Nov. 9 (03:07 UTC Nov. 10). Arcus paused platform withdrawals at 11:07 p.m. ET and deployed a fix at 11:37 p.m. ET. Withdrawals resumed at 4:26 a.m. ET Nov. 10, and Arcus Labs covered the shortfall from its treasury at 12:28 p.m. ET.
The incident involved one account and left other users’ balances, positions and orders unaffected. Arcus is tracking the withdrawn funds on-chain.
Arcus is a self-custodial trading protocol for stock tokens, crypto assets and perpetual futures. Its platform is unavailable in the United States.
Simon Yoon
ReporterSimon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to info@tokenpost.com.