Arbitrum’s Security Council secured approximately $30 million in assets linked to the October 29 Binance exploit, using emergency upgrade powers to move funds out of an attacker-linked addres
Arbitrum’s Security Council secured approximately $30 million in assets linked to the October 29 Binance exploit, using emergency upgrade powers to move funds out of an attacker-linked address without obtaining its private key.
The October 30 intervention moved 8,425 ETH and 74.56 million ARB into a holding address controlled through ArbitrumDAO governance. The assets remain frozen rather than returned to Binance, with a DAO vote required before they can be released. Arbitrum said no other users’ funds or applications were affected.
The 12-member council needs approval from at least nine members to execute emergency actions. Those powers allow it to upgrade network contracts without waiting for the normal governance process.
For this intervention, the council temporarily changed Arbitrum’s Ethereum-based Inbox contract, which carries messages into the Layer 2 network. The replacement code allowed two transactions to be processed as though they originated from the attacker-linked address, moving its ETH and ARB into the holding wallet.
The original contract implementation was restored within the same Ethereum transaction. The resulting Arbitrum transactions contained empty signature fields, security firm Zealynx found, demonstrating that the transfers did not require signatures from the targeted wallet.
The mechanism used authorized upgrade powers rather than compromising the wallet’s cryptographic keys. It also demonstrated that private-key ownership does not guarantee exclusive control over assets on Arbitrum One when governance can alter transaction-processing rules.
The council used the same approach in April to freeze approximately 30,766 ETH linked to the KelpDAO exploit. The Binance-related action marks its second such intervention this year.
Binance said on November 3 that the breach affected approximately $6.34 billion, with $2.85 billion frozen or intercepted. The FBI has attributed the theft to North Korea’s TraderTraitor operation.
The exchange traced the campaign to a tampered Homebrew installation downloaded in June and a separate September recruitment scam that persuaded another engineer to download malicious code. Attackers subsequently used compromised devices, an internal AI tool and stolen credentials to reach wallet-signing infrastructure.
The October 29 transfers included 233.46 million XRP. On Ethereum, malicious EIP-7702 authorizations allowed further transfers outside Binance’s normal withdrawal systems, meaning suspending customer withdrawals did not stop every outflow.
Binance said it had allocated more than enough funds to absorb the losses and replenished 98% of affected tokens, while purchasing the less liquid remainder. It also rebuilt affected systems, replaced compromised devices and revoked exposed credentials.
Those replacement purchases are separate from recovering stolen assets. Binance is engaging independent cybersecurity firms to review its preliminary findings, while the funds secured through Arbitrum’s intervention remain subject to a governance decision.
The post Arbitrum Secures $30M in Binance Hack Funds, Vote Pending appeared first on Crypto Adventure.
