Arcus Exploit: How a $2.23M Subaccount Accounting Bug Worked and What Users Should Check

Quick answer: On November 9, 2026, perpetual DEX Arcus lost 2,234,391 USDG when a bug in transfers between a user's own subaccounts let one new account record a balance far larger than it held and withdraw against it. Arcus says no user balances, positions or orders were affected, its treasury covered the shortfall, and withdrawals reopened on November 10.

What happened at Arcus?

Arcus is a decentralised exchange for perpetual futures. According to Cryptoticker's report, it runs on Robinhood Chain, uses the Paxos stablecoin USDG as collateral and settlement currency, and was built by the team behind dYdX.

In its official incident report, published November 10, Arcus says a newly created account exploited an accounting bug in how the exchange handled transfers between a user's own subaccounts. Under specific conditions, the account could record a balance far larger than it actually held, then request withdrawals against that inflated balance. Arcus says only that single account was involved.

The report states that "$2,234,391 USDG was withdrawn on-chain before withdrawals were stopped." A further $3 million in withdrawal requests was held by the bridge rate limit, never paid out and later reversed.

Timeline (ET)

• About 10:07 p.m., Nov 9: the exploit begins.
• 10:10 p.m.: the bridge rate limit engages and caps payouts.
• 10:15 p.m.: monitoring flags the activity.
• 11:07 p.m.: withdrawals are paused platform-wide and the status page is updated.
• 11:37 p.m.: a fix is deployed.
• 11:43 p.m.: the exploiter's addresses are blocked.
• 4:26 a.m., Nov 10: withdrawals are re-enabled.
• 5:02 a.m.: the exploiter's pending withdrawals are reversed.
• 12:28 p.m.: the shortfall is covered from the Arcus Labs treasury.

Why did it happen?

Most DeFi exploits target on-chain code: a flawed smart contract, a manipulated oracle or a compromised key. The Arcus incident was different. As Coin Edition explains, the system approved withdrawals based on an incorrect internal balance. The ledger entry was wrong, but the USDG that left through the bridge was real.

Why subaccounts are a risk area

Perp DEXs let users split funds across subaccounts to isolate margin for different strategies. Every internal transfer must debit one subaccount and credit another by exactly the same amount. If an edge case lets the credit exceed the debit, even briefly, the platform has effectively minted balance out of nothing. Withdrawal systems that trust that balance will then pay out real assets.

Arcus has not published the exact code path. It says it reviewed its code with security partners, which are not named.

What limited the damage

Two controls mattered. The bridge rate limit capped how fast funds could leave, which held back about $3 million. And withdrawal requests that had not yet settled could be reversed once the bug was found. Rate limits are often criticised as friction, but here they cut the potential loss by more than half.

Lessons for builders and power users

For teams running exchanges, perp DEXs or any platform with internal ledgers, the incident highlights three controls: invariant checks that compare the sum of subaccount balances against total deposits after every internal transfer, withdrawal rate limits sized to the platform's treasury, and the ability to hold or reverse unsettled withdrawals. For power users, it shows why spreading funds across venues and withdrawing idle balances reduces exposure to bugs you cannot see from the outside, no matter how well audited a platform's smart contracts are.

Who is affected?

• Arcus traders: Arcus says balances, positions and orders of all other users were unaffected, and trading and withdrawals are operating normally.
• Liquidity and treasury: the loss was absorbed by Arcus Labs. Cryptoticker notes this was a voluntary decision by the company, not an insurance payout.
• Exchanges and service providers: Arcus asked them to flag funds received from the exploiter's initial address, 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd.

How to verify your account

Step 1: Reconcile your balances

Compare your current Arcus balances, open positions and orders against your own records from before 10 p.m. ET on November 9. Arcus says nothing should have changed.

Step 2: Review withdrawal history

Check any withdrawal you requested between 10 p.m. ET on November 9 and 4:26 a.m. ET on November 10. Requests made during the pause may have needed to be resubmitted after withdrawals reopened.

Step 3: Confirm on-chain receipt

For any withdrawal, look up the transaction hash on the relevant explorer and confirm the USDG arrived at your address.

Step 4: Report discrepancies through official channels

If anything does not match, contact Arcus through the support address listed on its official site and incident report. Do not reply to people who contact you first.

What should you do next?

• Bookmark the official Arcus site, incident report and status page so you can find them again without search ads.
• Keep only the trading capital you need on any single venue; the rest belongs in self-custody.
• Review token approvals for wallets you connected to Arcus or other perp DEXs, and revoke any unlimited approvals you no longer need. Our guide on how to revoke token approvals after the Across domain hijack walks through the process.
• Read how other recent incidents unfolded, such as the Nostra oracle exploit and the NEAR Intents cross-chain exploit, to see which controls helped users in each case.

What should you avoid?

• Do not interact with unknown tokens or airdrops that appear in your wallet after the incident.
• Do not send funds to anyone offering to "recover" losses.
• Do not trust screenshots of supposed Arcus announcements; check the official blog and status page.

Official sources and status information

• Arcus: Incident report for November 9, 2026 (published November 10, 2026).
• Cryptoticker: Arcus exploit: perp DEX loses $2.23M to a sub-account bug (November 11, 2026).
• Coin Edition: How an accounting bug allowed hackers to drain $2.23 million (November 11, 2026).

Frequently asked questions

Conclusion

The Arcus exploit is a reminder that DeFi risk is not only in smart contracts: an off-chain accounting edge case let one account create balance it never deposited. Fast monitoring, a bridge rate limit and a treasury backstop kept users whole this time. Reconcile your own records, keep approvals tidy, and treat any "refund claim" link as a scam.

This article is for general information only and is not financial, legal or security advice for your specific situation. The Onchain Support is an independent publication and is not affiliated with Arcus, Arcus Labs, Robinhood or any exchange. We will never ask for your seed phrase, private keys, passwords or 2FA codes.