Arbitrum’s council rewrote core code to move $30 million of Binance hack funds without the hacker’s key
The Security Council changed Arbitrum’s core code
Arbitrum’s Security Council moved about $30 million in cryptocurrency taken in the Binance hack, without using the hacker’s password. The committee briefly rewrote one of the network’s core contracts to spend money from an address it did not control, then restored the original code.
At current prices, that is roughly $30 million, made up of more than 8,425 Ether and 74 million ARB tokens. It is small compared with the roughly $6.3 billion taken in the Binance hack, for which the FBI said on Oct. 31 the country’s TraderTraitor group was responsible.
On a normal blockchain, funds only move when the owner’s private key — a secret number only they know — signs off on the transfer. The council’s actions went against that rule. The recovery funds are now in a holding address and can only be moved through an ArbitrumDAO governance vote.
How the council did it
The Security Council is a 12-member group elected by holders of the ARB token. It can use emergency powers to upgrade the network’s smart contracts — the programs that run the platform — if nine members agree. This time, its Safe, a shared wallet needing nine signatures, sent one Ethereum transaction that temporarily replaced the code of Arbitrum’s Inbox. That is the contract that carries messages from Ethereum into Arbitrum.
The new code added a function called sendUnsignedTransactionOverride. It let the council send messages that Arbitrum treated as if they came from the exploiter’s address. The funds went to a holding address ending in 0DA0, and the original Inbox code was put back in the same transaction.
The council’s notice on the Arbitrum governance forum said: “No other user’s funds or applications were affected.” It added that the funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.”
Security firm Zealynx traced the movements and said the funds arrived on Arbitrum about 10 minutes later as type 0x65 transactions with blank signature fields, using the exploiter address’s own transaction counter.
- The Security Council moved roughly $30 million, or over 8,425 ETH and 74 million ARB, from an address linked to the Binance hack.
- The move used emergency upgrade powers requiring nine of the council’s 12 members to approve.
- The recovered assets now sit in a holding address and can only move through an ArbitrumDAO governance vote.
- The council has done a similar action once before this year, in April.
Why the upgrade path matters
Zealynx wrote that the council “used powers the DAO gave it and published both actions within an hour and a half.” The firm added that the usual rule — that an address only moves when its key signs off — holds “up to whoever controls the upgrade path.”
That caveat matters for a network that markets itself as decentralized. Whoever controls the upgrade path can make any address on Arbitrum spend money. Zealynx’s post about the action appeared on ethereum-magicians.org.
This is not the first time this year
Earlier this year, the council moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploit. Getting that Ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave, a crypto lending platform.
That earlier legal fight highlights the slow path ahead for the Binance funds, which will also need a governance vote before they move.
What is confirmed
- Arbitrum’s Security Council moved about $30 million of Binance hack funds last Friday using emergency upgrade powers.
- The council temporarily changed Arbitrum’s Inbox contract and restored the original code within the same transaction.
- The funds are now in a holding address that can only be accessed through an ArbitrumDAO governance vote.
- The council’s notice says no other user funds or applications were affected.
- The FBI attributed the Binance hack to the TraderTraitor group on Oct. 31.
What is still unclear
- The exact timeline for the next ArbitrumDAO governance vote to move the recovered funds.
- How long the legal or governance process may take before the funds leave the holding address.
Why this matters for crypto users
Most blockchains rely on private keys to let owners control their own funds. This incident shows that, on Arbitrum, a group of nine council members can temporarily override that control through emergency upgrades. For users holding ARB or using Arbitrum-based apps, it means the network’s upgrade process is a trusted point of control that can affect any address.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.