Arbitrum Council Uses Upgrade Powers to Transfer Funds Linked to Binance Exploit

The Arbitrum Security Council executed a controversial move last Friday, relocating 8,425 ETH and 74 million ARB that were associated with an address tied to the Binance exploit. While the amount equals roughly $30 million at current prices, the figure is negligible compared with the reported $6.3 billion taken from Binance.

Arbitrum operates as an Ethereum layer designed to lower transaction costs while safeguarding large sums of user deposits. On blockchains, funds typically move only when the wallet’s private key signs the transaction. However, Arbitrum’s governance structure grants its Security Council emergency upgrade powers that can alter contract code when at least nine of the 12 elected members agree.

How the Council Executed the Transfer

Using those emergency powers, the council’s Safe — a multisignature wallet requiring nine signatures — pushed a single Ethereum transaction that temporarily replaced the code of Arbitrum’s Inbox contract. The Inbox handles messages sent from Ethereum to Arbitrum. The temporary code introduced a function named sendUnsignedTransactionOverride, enabling the council to submit transactions that the network would accept as if they originated from the exploiter’s address.

The council then used this capability to move both ARB tokens and ether into a custody address ending in 0DA0. In the same Ethereum transaction, the original Inbox code was restored, according to the Security Council’s post on the Arbitrum governance forum.

Technical Traces and Governance Implications

Security firm Zealynx analyzed the activity and reported that the transactions arrived on Arbitrum roughly 10 minutes later as type 0x65 transactions with empty signature fields, still using the exploiter address’s transaction counter. Zealynx noted the council had exercised powers granted by the DAO and posted details publicly within about 90 minutes.

That said, the episode underscores a critical caveat for systems promoting decentralization: if an upgrade path exists, those who control it can force any address on Arbitrum to spend funds. In other words, canonical assumptions about ownership via private keys are contingent on the immutability of contract code and the governance mechanisms that can change it.

Precedent and Next Steps

This is not the Security Council’s first intervention. In April, it moved 30,766 ETH — then valued at roughly $71 million — out of the KelpDAO exploiter’s holdings after law enforcement identified the attacker. That earlier case saw weeks of legal and administrative hurdles before the DAO could approve transfers; claimants with outstanding judgments and a Manhattan federal court’s modified restraining order were all involved in the process.

The council stated that the newly transferred funds are frozen in the custody address and “can only be moved by an ArbitrumDAO Governance vote,” which will be coordinated with relevant stakeholders. The FBI has attributed the Binance hack to North Korea’s TraderTraitor group, according to its Oct. 31 attribution.