Arcus loses $2.23M to subaccount accounting bug on Robinhood Chain

Arcus, a perpetual futures and spot exchange on Robinhood Chain, says a bug in how it handled transfers between a user's own subaccounts let one account withdraw $2,234,391 in USDG it was not entitled to on 9 November. In its incident report, published on 10 November and announced on X, the exchange says it fixed the bug within the hour, that no other user balances, positions or orders were affected, and that it has covered the shortfall from its company treasury.

What happened

According to Arcus, at about 22:07 Eastern time on 9 November (03:07 UTC on 10 November) a newly created account exploited the bug. Under specific conditions it let the account record a balance far larger than it actually held, and the account then requested withdrawals against that inflated balance. Arcus says only that one account was involved.

What limited the loss was a control outside the exchange's own accounting. Three minutes after the first exploit, the bridge's on-chain withdrawal rate limit capped payouts and held back a further $3 million of requests, which were never paid out and were later reversed. Monitoring flagged the withdrawals at 22:15 ET.

Response

Arcus paused withdrawals across the platform at 23:07 ET and posted on its status page, deployed the fix at 23:37 and blocked the exploiter's addresses from trading, transferring and withdrawing at 23:43. Withdrawals reopened at 04:26 ET on 10 November, the exploiter's pending withdrawals were reversed at 05:02, and Arcus Labs covered the shortfall from its treasury at 12:28.

The company says the fix was reviewed by its security partners along with related checks across the codebase, and that it is improving its systems for detecting suspicious activity. It is working with blockchain investigators, is tracking the withdrawn funds on-chain, will coordinate with law enforcement as appropriate, and has published the exploiter's initial address.

What is not known

Arcus has not described the exact conditions that triggered the bug, named its security partners, or said whether any of the $2.23 million has been frozen or recovered.