Arcus pays out 2,234,391 USDG after integer underflow bug on Robinhood Chain
In brief
- Arcus paid 2,234,391 USDG to an exploiter across nine BridgeVault transfers, Crypto Briefing reported.
- CertiK attributed the incident to an integer underflow in subaccount transfer accounting.
- A bridge rate limit blocked an estimated $3 million in additional withdrawals.
- Arcus covered the shortfall from its company treasury, the exchange said.
How the exploit worked
A newly created account abused flaws in how Arcus handled transfers between subaccounts, which let it raise its balance well above what it had deposited, Crypto Briefing reported. The payouts went out in nine separate BridgeVault transfers to a wallet Arcus has since made public. (BridgeVault is how the exchange settles payouts in USDG.)
The smart contracts reportedly weren't the weak point. The failure sat in internal accounting logic for subaccount transfers, and the incident has been characterized as an internal accounting error rather than a smart-contract security flaw.
That distinction matters for how the headline number gets read. CertiK said the token count isn't an independently valued dollar loss or a measure of attacker profit. CertiK also noted the relevant ledger activity and on-chain executions landed on November 10 UTC (the same night as Arcus's November 9 ET date).
A fast rate limit, a slow pause
The bridge rate limit engaged around 10:10 p.m. ET, three minutes into the exploit, according to the incident timeline reported by Crypto Briefing. It blocked an estimated $3 million in additional withdrawals.
The platform-wide pause didn't come until 11:07 p.m.
That's nearly an hour after monitoring flagged the problem at 10:15. So the automated safeguard kicked in within minutes, while the full halt took close to an hour.
Treasury coverage and a bounty offer
Arcus said it covered the shortfall from its company treasury. It's published the exploiter's address and is working with blockchain investigators to trace the funds.
The exchange also reportedly offered the exploiter a bounty for returning a substantial portion of the tokens. Whether that offer's been accepted isn't known.
Crypto Briefing describes Arcus as a decentralized exchange aligned with the dYdX team. As of November 13, 2026, there were no reports of broader market contagion tied to the exploit.
Frequently asked questions
What caused the Arcus exploit?
Security firm CertiK attributed the incident to an integer underflow. A newly created account abused flaws in how Arcus handled transfers between subaccounts, which let it raise its balance well above what it had deposited. The failure reportedly sat in internal accounting logic, not in Arcus's smart contracts.
Does the 2,234,391 USDG figure mean the attacker made that much profit?
No. CertiK said the token count is not an independently valued dollar loss or a measure of attacker profit. It's the number of USDG paid out across nine BridgeVault transfers to the exploiter's wallet, according to Crypto Briefing.
How much did Arcus's rate limit stop?
The bridge rate limit engaged around 10:10 p.m. ET, three minutes into the exploit, and blocked an estimated $3 million in additional withdrawals, according to Crypto Briefing. The platform-wide pause came at 11:07 p.m.
