.png){kind=logo}
Arbitrum’s Security Council transferred approximately USD 30 million in cryptocurrency connected to the USD 6.3 billion Binance hack, using emergency network powers rather than the attacker’s private key. The October 30 intervention recovered over 8,425 ETH and 74 million ARB tokens, raising questions about decentralization and blockchain governance.
Arbitrum’s governance forum mentioned that the 12-member Security Council authorized an emergency contract modification through its nine-signature approval mechanism.
The council temporarily replaced code in Arbitrum’s Inbox contract, which processes messages from Ethereum. A function called ‘sendUnsignedTransactionOverride’ enabled transactions attributed to the attacker’s address without requiring its signature.
Two transactions redirected the assets to a protected wallet ending in 0DA0. The original contract code was restored during the same operation. “No other user’s funds or applications were affected,” the council stated.
Blockchain security firm Zealynx noted the transfers reached Arbitrum approximately 10 minutes after the Ethereum transaction. Researchers identified type 0x65 transactions containing empty signature fields and using the attacker’s transaction counter.
Zealynx reported no procedural vulnerabilities and noted that the council disclosed its actions within approximately 90 minutes. However, the intervention demonstrates that emergency upgrade authorities can override conventional wallet-signature protections.
Arbitrum previously used comparable powers in April 2026 to relocate 30,766 ETH, valued at approximately USD 71 million, associated with the KelpDAO exploit.
That recovery encountered legal complications when claimants pursuing judgments against North Korea sought access to the assets. A Manhattan federal judge subsequently modified a restraining notice before governance proceedings enabled their transfer to Aave.
The newly secured assets remain in custody pending an ArbitrumDAO governance decision. According to the council, the funds ‘can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.’
The FBI attributed the wider Binance attack to North Korea’s TraderTraitor group on October 31. Although the USD 30 million recovery represents less than 0.5% of Binance’s reported losses, it illustrates how emergency controls can protect assets while challenging expectations of unrestricted wallet ownership.
Also Read: Binance Users Withdraw USD 3.64 Billion Following Record Cryptocurrency Hack