Arcus DEX Exploit News: $2.23M Withdrawn, Treasury Covers Loss
What Happened in the Arcus DEX Exploit on November 9
Crypto news update: Arcus, a decentralized exchange built by the team behind dYdX, disclosed a bug that let one new account withdraw $2,234,391 USDG on November 9, 2026. The Arcus DEX exploit left user funds untouched.
The company announced the issue in an official X post on November 10. It says the bug is fixed and trading runs normally. Its own treasury covered the shortfall. The full report went up the same day.
How the Accounting Bug Inflated One Account Balance
The full incident report explains the flaw. It sat in how the platform handled transfers between a user's own subaccounts. Subaccounts split one profile into separate balances. Under certain conditions, an account could record a balance far larger than it held.
At about 10:07 PM ET, a newly created account used that gap. It then requested payouts against the fake balance. The balance was only a ledger entry, but the USDG that left on-chain was real.
The report says the incident involved a single account. No other accounts, balances, positions, or orders were affected.
Incident Timeline: From First Alert to Treasury Payout
All times below are ET and come from the official report.
Time | Event |
Nov 9, 10:07 PM | New account exploits the bug. |
10:10 PM | Bridge rate limit caps payouts. |
10:15 PM | Monitoring flags the withdrawals. |
11:07 PM | Platform-wide pause begins. |
11:37 PM | Fix goes live. |
11:43 PM | Exploiter addresses blocked |
Nov 10, 4:26 AM | Withdrawals re-enabled |
5:02 AM | Pending exploiter requests reversed |
12:28 PM | Treasury covers the shortfall. |
The first alert came eight minutes after the exploit began. The pause followed about 50 minutes later and lasted just over five hours. The exploiter addresses were blocked 96 minutes after the exploit began. Security partners reviewed the fix and related code checks.
Readers can compare that sequence of pause, fix, block, and repay with other crypto security incidents.
Impact: $2.23M Paid Out, $3M Held by a Rate Limit
In the Arcus DEX exploit, only $2,234,391 USDG left the platform on-chain before the pause. Another roughly $3M in requests was held by the bridge's on-chain rate limit. That money was never paid out and was later reversed.
Added up, the requests came to close to $5.2M. So the limit stopped more than half of them. A rate limit caps how much can be left in a set period. That is why the extra requests stalled instead of paying out.
Arcus Labs covered the temporary shortfall from its company treasury. No user balances were impacted, and open positions and orders stayed as they were.
Fund Recovery Efforts and Where the Platform Stands Today
The team is working with blockchain investigators. It will coordinate with law enforcement as appropriate. The withdrawn funds are being tracked on-chain.
The initial exploiter address is 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd. The team also asks exchanges and service providers to flag any funds received from it.
The official status page lists all systems as operational. Trading and withdrawals are running normally. Questions can go to support@arcus.xyz.
Arcus says it moved quickly to restore operations and add safeguards. It plans to use lessons from the incident to strengthen platform security and risk systems that spot suspicious activity.
In short, the Arcus DEX exploit stayed with one account. It was fixed the same night and repaid from company funds. Any new findings will appear in the latest crypto updates as they emerge.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.
