Arbitrum’s Security Council executed an emergency chain-level override on October 30, freezing assets tied to the October 29 Binance hack within roughly ten minutes. According to the council’s emergency action disclosure, the operation moved 8,425 ETH and 74.6 million ARB to a holding address ending in 0DA0, with release possible only through a separate ArbitrumDAO governance vote.
The action began at 8:08 a.m. Hong Kong time and repeated the same Inbox override mechanism used in April after the KelpDAO exploit. The council upgraded the Ethereum mainnet Inbox contract with a new function, sendUnsignedTransactionOverride, allowing it to impersonate the transaction sender. Two unsigned messages named the exploit address as sender and directed its ETH and ARB to the holding address. The original Inbox code was restored inside the same Ethereum transaction, which settled at 00:08:35 UTC; Arbitrum One processed the ARB transfer about ten minutes later at 00:18:20 UTC.
Security firm Zealynx noted that because the upgrade and restore occurred in one transaction, common monitoring tools comparing implementation addresses before and after each block would see identical code. The change is visible only in contract upgrade events and execution traces. On Arbiscan, the ARB transfer appears as a normal token movement, but its transaction type is listed as 101 (0x65), Arbitrum’s label for an unsigned transaction entering from Ethereum. No cryptography was broken; the attacker’s private key was not used.
The council said no other user funds or applications were affected. Press estimates valued the frozen assets near $30 million, a small portion of the roughly $6.3 billion Binance says was withdrawn. The same mechanism was used on April 21 to pull 30,766 ETH from the KelpDAO exploiter, and the same holding address received those funds. Under the ArbitrumDAO constitution, nine of the council’s 12 members may approve emergency actions without delay, but the power is limited to genuine security emergencies and requires a transparency report.
Critics have raised scope concerns. Robby Greenfield of Tokedex said the impersonation capability is "not scoped to recovery," while delegate MconnectDAO asked for an emergency action policy. Others argued pre-authorized, narrowly scoped emergency powers are better than unaccountable admin keys. In the April case, a release proposal involved Aave Labs, KelpDAO, LayerZero, EtherFi and Compound, and a U.S. court later altered the recipient in Kim v. Democratic People’s Republic of Korea.
In April, the proposed release schedule estimated about 49 days from posting to execution, including forum discussion, a Snapshot temperature check, onchain voting, waiting periods and finalization. Delegate DZack23 later said cutting early stages still leaves at least 35 days. Next steps will require a release proposal on the Arbitrum governance forum, a transparency report, and possibly further court involvement. TRM Labs and Chainalysis have linked the Binance theft to North Korean hackers, while Binance has pledged to cover customer losses from its own funds.
