Arcus Perps Subaccount Accounting Exploit

On November 10, 2026, Arcus, a perpetuals and stock-token exchange on Robinhood Chain, lost approximately $2.2 million when an attacker exploited an accounting bug in transfers between a single account's own subaccounts, inflating its balance to withdraw funds it never deposited.

What happened

The flaw sat in how Arcus booked transfers between a user's own subaccounts. After an internal subaccount transfer, the exchange credited the account a balance well above its actual holdings; a newly created account then submitted withdrawals against that inflated figure and pulled out 2,234,391 USDG on-chain. Arcus characterised the root cause as an error in its own bookkeeping — not a blockchain flaw or a stolen key — though it has not published code or a full technical post-mortem. The exploit began around 03:07 UTC on November 10 (late on November 9 US Eastern), and a further ~$3 million in withdrawal requests was held back by the bridge's on-chain rate limit and never paid out. Security firm 0xCERT catalogued the incident as advisory 0xCERT-2026-0338. On-chain trackers reported the exploiter address receiving roughly 1,052 ETH on Ethereum, routed largely through a Relay router, with about 53 ETH later sent to THORChain.

Aftermath

Arcus paused platform-wide withdrawals at 04:07 UTC, deployed a fix around 04:37 UTC, blocked the exploiter's addresses at 04:43 UTC, and re-enabled withdrawals for all users by 09:26 UTC; the exploiter's pending withdrawals were reversed at 10:02 UTC. By 17:28 UTC, Arcus Labs had covered the full shortfall from its own company treasury — a voluntary decision with no deposit insurance behind it — making affected users whole, though the stolen funds themselves were not recovered. Arcus published the exploiter's initial address, 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd, so exchanges and service providers could flag related assets, and said no other user balances, positions or orders were affected.

Why it matters

Arcus is a reminder that a venue's internal ledger is as much an attack surface as its smart contracts. The exploit touched no on-chain vulnerability and stole no key; it simply fed the exchange's off-chain bookkeeping a transfer it mishandled, letting an account credit itself value it never held — functionally the same drain as the on-chain share-minting flaw that emptied ACryptoS days earlier, reached by a different route. It also shows the double-edged nature of a well-funded, semi-centralised operator: on-chain rate limits capped the damage and a company treasury made users whole, an outcome most unfunded DeFi protocols cannot offer — yet the absence of a published post-mortem leaves the exact faulty component unverifiable. For a perpetuals venue like Drift Protocol, user trust rests on the integrity of internal accounting as much as on key custody.