How Arbitrum Froze a Hacker’s Crypto in 10 Minutes

Arbitrum’s Security Council has again made an exploiter’s address hand over its funds without the private key, this time freezing assets tied to the October 29 Binance hack.

Key Takeaways

• Council moved 8,425 ETH and 74.6M ARB
• Same Inbox override used in April’s KelpDAO freeze
• ARB transfer recorded as unsigned type 0x65
• Release requires a separate ArbitrumDAO governance vote

According to the Security Council’s emergency action disclosure, the move executed at 8:08 a.m. Hong Kong time on October 30 and sent the funds to an address ending in 0DA0, which they can leave only through an ArbitrumDAO vote. The council said no other user’s funds or applications were affected. Press estimates valued the frozen assets near $30 million, a small slice of the roughly $6.3 billion Binance says was withdrawn from its wallets.

Three separate powers were in play. The council never had the first: the ability to sign for the wallet. It used the second: control over how Arbitrum One accepts transactions. The third, deciding who ends up with the money, sits with the DAO and, as an earlier freeze this year showed, partly with a U.S. court.

What the Council Changed Inside the Inbox

Messages from Ethereum reach Arbitrum One through the Inbox contract on Ethereum mainnet. A standard cross-chain transaction sent this way carries its sender’s own identity, which is why an Ethereum account cannot normally use it to act as someone else on Arbitrum. The council upgraded the Inbox with a new function, sendUnsignedTransactionOverride, which the disclosure says added “the ability to impersonate the transaction sender.”

Two messages built with that function named the exploit address as sender and directed its ETH and ARB to the holding address. The last step put the original Inbox code back. All of it ran inside a single Ethereum transaction at 00:08:35 UTC. Arbitrum One processed the result about ten minutes later, with the ARB transfer settling at 00:18:20 UTC.

Packing the upgrade and the restore into one transaction hides the change from a common kind of monitoring. A watcher that compares the Inbox’s implementation address before and after each block would see identical code on both sides, a gap flagged in a technical reconstruction by security firm Zealynx. The upgrade surfaces in the contract’s upgrade events and in the transaction’s execution trace, which is where anyone auditing these actions has to look.

No cryptography was broken along the way. The attacker’s key stayed wherever the attacker keeps it, and the council changed which sender the network would accept.

What Arbiscan Shows – and What It Leaves Out

Open the ARB transfer on Arbiscan and the token log reads like any wallet sending tokens: the exploit address on the from line, the 0DA0 address on the to line. The giveaway sits in the transaction type, listed as 101, or 0x65, Arbitrum’s label for an unsigned transaction that entered from Ethereum. The exploit address produced no signature because the route asked for none.

Tools that treat every outgoing transfer as the owner’s decision would misread this one. A wallet-labelling service, a compliance screener or an explorer summary could record the exploiter as having moved the funds when the council did. Zealynx makes the same point from the contract side: the ARB token contract saw an ordinary transfer event and had no way to tell the difference.

The transaction type proves little by itself. Ethereum accounts use unsigned transactions legitimately to reach Arbitrum from mainnet. What separates an override from routine use is the Ethereum message behind it and whether the Inbox implementation changed inside that same transaction.

Suspected $106M Crypto Theft Ran Through Familiar Wallets

Nine of Twelve Signatures, Twice in Six Months

The Binance freeze repeats a playbook. On April 21, the council used the same function and the same holding address to pull 30,766 ETH from the KelpDAO exploiter after an attack on KelpDAO’s rsETH bridge route.

The authority comes from the ArbitrumDAO constitution, which gives the DAO and the council chain-owner privileges on Arbitrum One, meaning control over core contract upgrades and system settings. Nine of the council’s 12 members can approve an emergency action with no delay. The constitution limits that path to genuine security emergencies and requires a transparency report afterward, and the DAO can narrow or remove the powers through a constitutional proposal.

Stablecoin freezes work at a different layer. Circle and Ripple froze tokens linked to the Binance theft through controls built into their own assets, and Coindoo has traced how the attacker sidestepped those controls by borrowing ETH against stolen stablecoins. ETH has no issuer to blacklist it, but ETH on Arbitrum One sits in a ledger the council can upgrade. The disclosure does not say whether the ETH it froze came from those loans.

Critics in the April thread focused on scope. Robby Greenfield of Tokedex wrote that the impersonation capability is “not scoped to recovery,” and delegate MconnectDAO asked the council to publish an emergency action policy defining when it may bypass governance. Delegate deakeegroup argued the opposite case, calling pre-authorized, narrowly scoped emergency powers better than either no emergency path or admin keys with no accountability. On October 11, a participant in the same thread was still asking whether work on such a policy had begun.

For anyone holding assets on Arbitrum One, custody comes down to two questions: who holds the key, and who can change the rules that key operates under. On Arbitrum One, the second answer is nine of 12 council signers, bounded by the constitution. Chains built on Arbitrum’s technology answer it separately, since each has its own administrators.

Where the Money Goes Is a Separate Vote

The October disclosure leaves the destination open, saying only that a governance vote must move the funds and that it is being coordinated with relevant parties. April shows what that process involves. Aave Labs, KelpDAO, LayerZero, EtherFi and Compound posted a Constitutional AIP on April 25 that named a recovery multisig as recipient, tied the ETH to restoring rsETH’s backing and committed Aave Labs to indemnify the Arbitrum Foundation, Offchain Labs and council members. The authors also set out a stage-by-stage schedule:

Release schedule in the April proposal

1. Forum discussion: 1 week
2. Snapshot temperature check: 1 week
3. Delay after onchain submission: 3 days
4. Onchain vote: 14 days, extendable to 16
5. Arbitrum waiting period: 8 days
6. Arbitrum-to-Ethereum message finalization: typically at least 1 week
7. Ethereum waiting period: 3 days

Authors’ estimated total: about 49 days from posting to execution.

A court then changed the recipient. Plaintiffs in Kim v. Democratic People’s Republic of Korea, who hold an unpaid U.S. judgment against North Korea, had served a restraining notice on “Arbitrum DAO.” A federal order filed May 8 allowed an onchain vote to send the frozen ETH to a wallet controlled by Aave LLC, bound Aave LLC to the restraint once it received the funds and reserved every other question about the assets. The proposal was amended to that recipient and appeared among Arbitrum’s active onchain votes by May 26.

Delegate DZack23 set out the floor on timing during that debate. Cutting the discussion and temperature-check stages still leaves at least 35 days, he wrote. In his view, using another emergency action to speed up a release would breach the constitution, because the pace of a recovery is not a security emergency.

The Binance funds carry the same kind of attribution that drew creditors to the KelpDAO ETH. TRM Labs and Chainalysis have linked the Binance theft to North Korean hackers. Binance, for its part, has pledged to cover customer losses from its own funds, so the claimant here is a single exchange rather than April’s coalition of protocols. Coindoo has examined why seized crypto often reaches victims late, and this case adds a governance vote, and possibly a court, to that queue.

Three records would show the next step: a release proposal on the Arbitrum governance forum naming a recipient, the transparency report the constitution requires for the October action, and any court filing that names the 0DA0 balance. Arbitrum’s November 3 open governance call was the first scheduled proposal discussion since the freeze. If a proposal follows April’s route, the schedule above sets the earliest point the funds could move, and a restraining notice could change the recipient before then.