Arbitrum council freezes $30 million tied to Binance hack

Arbitrum’s Security Council moved 8,425 ETH and 74,559,805.2 ARB tied to the Binance exploit into a holding address on Oct. 30, without the attacker’s signature, according to the council’s emergency notice. CoinDesk valued the assets at about $30 million, a small share of the roughly $6.3 billion taken from Binance.

How did the council move funds without the attacker’s key?

The council temporarily changed Arbitrum’s Inbox contract on Ethereum so it could create transactions that the network treated as coming from the exploit-linked address, according to the notice. It sent two cross-chain transactions to move the assets, then restored the Inbox contract’s original code in the same atomic action.

CoinDesk reported that the 12-member council used a shared wallet requiring nine signatures to approve the emergency upgrade. The method relied on the council’s ability to change the network’s contract code, rather than access to the attacker’s private key.

Who controls the assets now?

The funds are held at an address ending in 0DA0 and can be moved only by an ArbitrumDAO governance vote, the council said. That puts their eventual release in the hands of the DAO rather than the Security Council alone.

The council said no other users’ funds or applications were affected. CoinDesk reported that security firm Zealynx traced the transfers and found blank signature fields in the resulting Arbitrum transactions.

What happens next?

The council said any move from the holding address will be coordinated with relevant parties through an ArbitrumDAO vote. Its notice did not give a timetable or name a proposed recipient for the funds, so their eventual destination remains unconfirmed.

Source material

• council’s emergency notice — forum.arbitrum.foundation