Arbitrum’s Security Council reclaimed more than 74.5 million ARB tokens and approximately 8,426 ETH from a compromised address on October 30. The assets were taken following a security incident linked to an exploit at Binance, according to a technical walkthrough shared by Zealynx on the Ethereum Magicians forum.
Coordinated response after Binance wallet drain
The Security Council initiated the asset transfer at 8:08 a.m. Hong Kong time, moving the funds to secure addresses. The council described the compromised wallet as being associated with the Binance exploit that led to significant losses for the exchange, which estimates the total at about $6.3 billion in drained hot wallets. The action came within hours of the incident, reflecting the council’s ability to respond rapidly in emergency situations.
This was not the first time the council had acted to freeze or recover stolen assets. In April, it moved over 30,765 ETH linked to the KelpDAO exploit on Arbitrum One, employing similar emergency governance processes.
Mechanism does not rely on wallet’s private key
Zealynx’s analysis indicates that the Security Council did not require the private key for the compromised address. Instead, it leveraged its update authority within the protocol through its Safe, which needs nine of twelve signers to approve actions. Using a technical procedure, the council’s Safe called Arbitrum’s UpgradeExecutor in a single Ethereum transaction (block 26301886), briefly overwriting the protocol to designate the target address as the sender for the transfer. The process reverted the protocol’s code immediately after each transaction, repeating it for each asset—first ARB, then ETH.
Unchained cross-checked on-chain data and confirmed that both transfers were executed on Arbitrum One approximately 10 minutes after the initial Ethereum transaction. The ARB and ETH were sent as type 0x65 transactions with empty signature fields, using the wallet’s next available nonces, and delivered to a secure holding address.
Nothing within the ARB token’s logs reflected an unusual move; the transfer appeared as a standard transaction. Zealynx pointed out that the only discernible difference was the transaction’s technical type and its blank signature, highlighting the use of emergency protocol-level controls.
DAO oversight and emergency protocols
The Security Council’s notice clarified that the seized assets can only be moved through an ArbitrumDAO governance vote in collaboration with stakeholders. The council emphasized that no user funds or applications besides those related to the exploit were affected.
Offchain Labs co-founder and CEO Steven Goldfeder previously explained that the council’s capacity to intervene in such emergencies is a deliberate aspect of the protocol’s governance. He described the Security Council as an “external entity, broadly elected” and stressed that responsibility does not rest with any single developer or executive.
Zealynx concluded that no vulnerabilities were found in the process. The Security Council operated within the powers assigned by the DAO and disclosed the actions promptly. The walkthrough emphasized that, on blockchains like Arbitrum One, actual control depends on those who hold upgrade authority, which in this case includes both the Security Council’s emergency Safe and the DAO’s timelock on Ethereum.
With emergency governance actions increasingly shaping outcomes in response to high-profile exploits, monitoring on-chain assets and governance activity becomes critical. CryptoAppsy’s real-time tracking tools and live news updates can help users follow rapid developments like the movement of large sums in $ARB and key decisions by DAO authorities. These features enable proactive portfolio and protocol risk monitoring during volatile security events.
