Arcus Reimburses 2.23 Million USDG Taken in Subaccount Exploit

Decentralized exchange Arcus said an attacker exploited an accounting flaw between subaccounts to withdraw 2,234,391 USDG at 10:07 p.m. ET Nov. 9 (03:07 UTC Nov. 10), prompting a temporary halt to withdrawals.

The flaw involved how funds moving between subaccounts were recorded, allowing an account's balance to be overstated before a withdrawal. Arcus said the incident involved one account; other users' balances, positions and orders were unaffected.

A separate withdrawal request worth about $3 million was blocked by cross-chain bridge limits and later canceled. Arcus paused all withdrawals at 11:07 p.m. ET Nov. 9 (04:07 UTC Nov. 10), fixed the flaw about 30 minutes later and reopened withdrawals at 4:26 a.m. ET Nov. 10 (09:26 UTC).

Arcus Labs used company reserves to cover the full shortfall. The company is working with blockchain investigators to trace the withdrawn tokens and said it would cooperate with law enforcement if needed. The exploit involved the platform's internal bookkeeping for subaccount transfers.