Arbitrum’s Security Council executed an emergency intervention on October 30, 2026, transferring approximately $30.5 million in cryptocurrency tied to the Binance security breach into a frozen intermediary wallet. The operation secured 8,425 ETH and 74,559,805.2 ARB from an address associated with the exploit on Arbitrum One, moving the funds to a restricted wallet ending in 0DA0.
According to an official statement on the Arbitrum governance forum, the transfer occurred at 8:08 a.m. Hong Kong time. The assets can only be moved following an ArbitrumDAO governance vote. The Security Council temporarily modified Arbitrum’s inbox contract on Ethereum, introducing a function called sendUnsignedTransactionOverride to reproduce cross-chain transactions while impersonating the sender. The inbox contract was restored afterward, and the council emphasized no other users’ funds were affected.
The action forms part of a wider response to the Binance hot-wallet incident, which Binance estimates affected approximately $6.3 billion in cryptocurrency assets. Binance said roughly $3 billion had already been frozen across blockchain networks and token issuers. Its preliminary investigation pointed to a compromised DevOps engineer’s laptop, unauthorized access to a service container, and fraudulent withdrawal transactions, while finding no evidence of a wallet private-key leak.
Blockchain security firm Blockaid identified a successful EIP-7702 delegation among 50 authorizations submitted against Binance’s live hot wallet. The attacker submitted authorizations across nonces 18,914,775 to 18,914,824, and the one that matched activated a malicious contract with a restricted sweep() function. That resulted in the transfer of about 167,464 ETH and dozens of tokens, with the operator’s funding traced to Tornado Cash withdrawals.
Aave’s risk service provider LlamaRisk said a wallet deposited approximately $60 million USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH, valued at about $44.6 million. Aave froze 175 V3 reserves across 16 networks and 117 V4 reserves across four networks to prevent new deposits and borrowing while preserving withdrawals, repayments, and liquidations. LlamaRisk recommended temporary interest-rate adjustments because frozen deposits alongside continuing withdrawals can raise variable borrowing costs.
Binance temporarily suspended deposits and withdrawals, revoked the affected address authorization, and committed SAFU reserves and corporate funds to cover customer losses. The exchange pledged an updated Proof of Reserves after remediation. TRM Labs attributed the incident to North Korea’s TraderTraitor operation, though Binance has not publicly confirmed the attackers’ identities. The intervention highlights the balance between decentralized transaction finality and emergency governance powers on layer-2 networks.
