Arbitrum Security Council Relocates $30M Binance Hack Funds Without Attacker Key

TL;DR

• Fund Recovery: Arbitrum Security Council moved more than 8,425 ETH and 74 million ARB, worth roughly $30 million, from an address tied to the Binance exploit.
• Emergency Mechanism: Council members temporarily modified the Inbox contract, enabling special transactions that the network treated as originating from the exploiter’s address.
• Governance Debate: The operation protected assets and affected no other users, but it also highlighted that emergency upgrade powers allow participants to override normal wallet signature assumptions.
  

  ---

Arbitrum‘s Security Council has transferred more than 8,425 ETH and 74 million ARB from an address linked to the Binance exploit, securing roughly $30 million in assets without any action from the attacker. The move highlights the extraordinary powers available to the network’s emergency governance structure and has renewed discussion about how much control exists within the protocol.

According to the council’s notice, the assets were moved into a holding address after members approved an emergency intervention. The funds can now only be moved through a DAO governance vote coordinated with relevant parties. No other user funds or applications were affected during the process.

How the Council Moved the Funds on Arbitrum

The Security Council is a 12-member group elected by ARB token holders and can execute emergency actions when at least nine members agree. To carry out the transfer, the council temporarily modified the Inbox contract that relays messages from Ethereum into Arbitrum. The replacement code introduced a function called sendUnsignedTransactionOverride.

That function allowed the council to create transactions that Arbitrum recognized as originating from the exploiter’s address, despite no private key signature being provided. Using this mechanism, the council executed two transactions that moved both the ETH and ARB holdings into a secure wallet. Immediately afterward, the original Inbox code was restored within the same transaction sequence.

Emergency Powers Raise Governance Questions

Security firm Zealynx traced the transfers and reported that the funds appeared on Arbitrum about 10 minutes after the Ethereum transaction. The transactions reportedly arrived with blank signature fields but still used the exploiter address’s existing transaction counter. The move demonstrates that Arbitrum can intervene in exceptional situations through its upgrade authority.

Zealynx noted that the common assumption that an address can only move funds with its private key ultimately depends on who controls the network’s upgrade path. That reality may attract additional scrutiny because Arbitrum is widely promoted as a decentralized network. In practice, the ability to alter core contracts means authorized governance participants can direct how Arbitrum processes transactions during emergencies.

Previous Action Shows a Familiar Playbook

This is not the first time Arbitrum has exercised these powers. In April, the council transferred 30,766 ETH worth about $71 million from a KelpDAO exploiter after law enforcement identified the attacker. For Arbitrum users, the latest action demonstrates both the strengths and tradeoffs of emergency governance. The latest Arbitrum intervention successfully secured funds connected to the Binance exploit, but it also underscores how much authority remains concentrated within the network’s approved upgrade framework.