TLDR
- Arcus found an accounting bug on November 10 that let a user withdraw funds they did not own.
- About $2.234 million in USDG left the platform before withdrawals were stopped.
- Another $3 million in withdrawal requests was blocked by cross-chain bridge limits.
- Arcus Labs repaid the full shortfall from its company treasury.
- The attacker’s first address has been published so exchanges can flag related assets.
Arcus, a decentralized trading platform, reported an accounting vulnerability on November 10. The flaw let a user withdraw money they were not entitled to. The company said it found and fixed the problem within one hour.
⚠️ ALERT: $2.23 MILLION drained from Arcus DEX after accounting bug allows exploiter to inflate account balance
Arcus DEX suffered a $2.23 million exploit on November 9 after an accounting bug allowed a newly created account to record a balance far larger than its actual… pic.twitter.com/UcRz4uYLMP
— Coin Bureau (@coinbureau) November 11, 2026
The attack began at 11:07 Beijing time, which is UTC+8. A newly created account was the source. The account took advantage of how Arcus handled transfers between user sub-accounts.
How the Exploit Worked
Arcus said the bug let the new account record balances far larger than what it actually held. The account then asked to withdraw those inflated amounts. The platform processed some of those requests before the team stopped withdrawals.
On Nov 9, Arcus identified and fixed a bug which permitted an unauthorized withdrawal.
No user funds were affected and Arcus has covered the shortfall from its company treasury. Trading and withdrawals are operating normally.
Full incident report:https://t.co/Rtv0XqVBhq
— Arcus (@arcus_xyz) November 10, 2026
In total, about $2.234 million in USDG was withdrawn on-chain. USDG is a stablecoin, and it was trading at $1.00 at the time of the reports. That figure is the amount Arcus says left the platform.
The attacker also tried to take out more. Withdrawal requests worth an additional $3 million were submitted. The cross-chain bridge’s rate limits blocked them.
Those blocked requests were never paid. Arcus later canceled them. The company did not say how many requests were involved.
The bridge limits capped how much could move in a set period. This kept the loss to the $2.234 million that had already been withdrawn. Arcus did not give further detail on how the limits are set.
Arcus Covers the Loss
Arcus Labs said it has fully replaced the missing funds. The money came from its corporate treasury. The company said this means user balances were not affected.
Arcus also said trading and withdrawals continued as normal. Users were not asked to take any action. The company did not report any delay in service.
The team is now working with blockchain investigators. Their goal is to trace where the stolen funds went. Arcus has not said whether any of the money has been recovered.
Arcus has published the attacker’s initial address. It asked exchanges and service providers to flag any assets linked to that address. This lets other platforms watch for the funds if they try to move them.
The company has not named the attacker. It also has not said whether the person is tied to any known group. Arcus did not share the full list of affected wallets.
Arcus said the bug sat in its handling of transfers between sub-accounts. The company said the fix was in place within an hour of detection. It did not say whether an outside audit will follow.
The CROSS token, listed alongside the news on one report, was priced at $0.1054. It was up 3.71% at the time. The reports did not link that price move to the exploit.
As of the latest reports, Arcus says the shortfall is fully covered and the platform is running normally. Investigators are still tracing the funds, and the attacker’s address remains public.
