- Arcus DEX lost $2.23 million after hackers exploited a flaw in its accounting system.
- Arcus Labs used funds from its company treasury to fully cover the losses.
- Withdrawal limits blocked another $3 million in attempted withdrawals.
Arcus DEX has suffered a $2.23 million exploit after a flaw in its accounting system allowed an attacker to withdraw money that was never deposited.
The attack happened on November 9, 2026, and targeted the platform’s subaccount transfer system. The attacker manipulated account balances to make it appear that more funds were available for withdrawal than actually existed.
Arcus Labs says it has covered the entire $2.23 million loss using company funds, so other users were not financially affected. The platform also stopped another $3 million in attempted withdrawals through its security controls.
How the Attack Happened
The attacker exploited a weakness in how Arcus handled transfers between subaccounts.
Subaccounts allow users to divide their funds into separate trading accounts under one main wallet. However, a flaw in Arcus’s accounting system allowed the attacker to manipulate the balance shown in one of these accounts.
This made it appear as though the attacker had more money than they actually deposited.
Arcus’s system then approved withdrawals based on the incorrect balance, allowing the attacker to take real funds from the platform.
According to the incident report, approximately 2,234,391 USDG was successfully withdrawn before Arcus suspended withdrawals.
The attack involved a newly created account. Arcus also said there was no evidence that other users’ balances, trading positions, or orders were affected.
Importantly, this was an accounting bug, not a private-key hack. The attacker exploited how the platform calculated account balances rather than gaining access to another user’s wallet.
Follow us on X for real-time crypto updates.
Withdrawal Limits Prevented Another $3 Million Loss
Notably, Arcus’s withdrawal security system helped prevent the damage from becoming worse. During the attack, the hacker attempted to withdraw an additional $3 million. However, an on-chain withdrawal limit blocked the transactions.
As a result, the confirmed loss remained at $2.23 million instead of the potential $5.23 million.
Following the attack, Arcus:
- Temporarily suspended withdrawals.
- Fixed the accounting vulnerability.
- Blocked the attacker’s addresses from trading, transferring, and withdrawing funds.
- Reviewed its code with security partners.
Withdrawals were suspended at 11:07 PM Eastern Time on November 9. The vulnerability was fixed about 30 minutes later, and withdrawals resumed at 4:26 AM on November 10.
Arcus Covers the Entire $2.23 Million Loss
Arcus Labs confirmed that it used company treasury funds to cover the full $2,234,391 shortfall. The company stressed that only one account was affected and that other users’ funds and trading activities remained safe.
Meanwhile, Arcus shared the attacker’s wallet address and asked crypto exchanges and other service providers to flag funds linked to the address.
There have also been reports of a proposed deal offering the attacker a 10% reward for returning 90% of the stolen funds by November 13. However, this offer has circulated through security-alert accounts and has not been confirmed in Arcus’s official incident report.
What the Exploit Means for Other DeFi Platforms
The Arcus incident highlights the risks facing DeFi, especially those offering perpetual futures and multiple collateral options.
Security risks do not always come from hackers stealing private keys or exploiting smart contracts. Sometimes, a simple mistake in how a platform calculates account balances can create an opportunity to steal millions.
The incident also shows why withdrawal limits are useful. Although the attacker stole $2.23 million, Arcus’s security controls prevented another $3 million from leaving the platform.
The company’s trading and withdrawals have returned to normal, and users have been protected from the immediate financial impact.
Subscribe to our YouTube channel for the latest crypto news.
Related: Elon Musk vs CZ: How Their Binance Hack Sparked an Ongoing X Spat
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
