Arbitrum Council Moved $30M in Binance Hack Funds via Temporary Contract Upgrade
Arbitrum's Security Council used a temporary change to its Ethereum inbox contract to move 8,425 ETH and about 74.56 million ARB linked to the Binance hack into a holding address. Further movement of the funds now requires an ArbitrumDAO governance vote, and the intervention was the second emergency action of its kind this year.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What the Security Council Did
Arbitrum's Security Council moved 8,425 ETH and 74,559,805.2 ARB linked to the Binance hack into a holding address on October 30, according to the network's emergency-action notice. The notice gives the time as 08:08 HKT. CoinDesk valued the moved assets at roughly $30 million, a figure Crypto.news did not repeat, so the dollar amount should be read as a single-outlet estimate.
The intervention did not require the attacker's private key. Contributors prepared a temporary change to the network's Ethereum inbox contract, council members verified and signed it, and the original implementation was restored after the transfers. The added function, sendUnsignedTransactionOverride, could imitate a cross-chain transaction while impersonating its sender. Two messages moved the assets from the identified address into the holding address ending 0DA0.
Why the Attacker's Key Was Not Needed
An ordinary payment is authorised by the account that sends it. The Arbitrum case differs because the Security Council used administrative authority over the infrastructure that handles messages from Ethereum to the rollup. Arbitrum's constitution gives chain-owner privileges to the DAO and the Security Council, including the power to change core protocol implementations and parameters, along with associated contracts on Ethereum.
Arbitrum's developer documentation describes how parent-chain messages enter the rollup through inbox infrastructure, and that users can submit transactions through a delayed inbox when the sequencer is unavailable or does not include them. The emergency function was a separate, temporary override. A normal user's access to the delayed inbox does not grant the sender-impersonation authority used in the action.
Scope and Limits of the Action
The two reports frame the outcome differently. CoinDesk describes the episode as the council briefly rewriting a core contract and then restoring it, and notes it is the second time this year the council has taken such a step. Crypto.news and Arbitrum's notice emphasise that the action froze the funds rather than returned them. Arbitrum's notice reserves further movement to ArbitrumDAO governance, so moving funds away from the exploiter and returning them to an entitled recipient are separate decisions.
Arbitrum said the upgrade, transfers and restoration formed an atomic action, with the operations bundled so the emergency implementation was not meant to remain active afterward. The notice identifies the administrative transaction as 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6. Ethereum provided the venue for the administrative transaction while the assets were held on Arbitrum One. Based on the notice, the event did not demonstrate a power to rewrite unrelated Ethereum accounts or to move native bitcoin on another network.
What Comes Next
The holding address now requires an ArbitrumDAO governance vote before any further transfer, which places the decision on the destination of roughly $30 million in stolen funds with token holders rather than the council. Users of upgradeable systems, as this episode illustrates, depend on how administrative permissions are distributed and constrained, not only on whether they control their own keys.
Why It Matters
For Traders
ARB holders should note that the seized funds now sit behind a DAO vote, so any return or sale timeline depends on governance outcomes rather than the council's action.
For Investors
The episode shows that Arbitrum's chain-owner privileges can override user custody in emergencies, a governance tradeoff that will shape how the market values the network's security model.
For Builders
Protocols deploying on Arbitrum should audit how the Ethereum inbox and upgrade permissions affect their assumptions about asset finality and sender authentication.
This article is for information only and is not financial advice. Read the full disclaimer.
