Arbitrum's Security Council has secured approximately $30 million in assets linked to the October 29 Binance exploit, using emergency upgrade powers to move funds out of an attacker-linked address without obtaining its private key.

The October 30 intervention, executed one day after the exploit, moved 8,425 ETH and 74.56 million ARB into a holding address controlled through ArbitrumDAO governance, as documented in a Security Council post on the Arbitrum governance forum. The assets remain frozen rather than returned to Binance, with a DAO vote required before they can be released, leaving the funds' final disposition to ArbitrumDAO governance rather than the council that carried out the freeze. Arbitrum said no other users' funds or applications were affected.

Emergency Upgrade Overrides Signature Requirements

The 12-member council needs approval from at least nine members to execute emergency actions. Those powers allow it to upgrade network contracts without waiting for the normal governance process.

For this intervention, the council temporarily changed Arbitrum's Ethereum-based Inbox contract, which carries messages into the Layer 2 network. The replacement code allowed two transactions to be processed as though they originated from the attacker-linked address, moving its ETH and ARB into the holding wallet. The original contract implementation was restored within the same Ethereum transaction.

Security firm Zealynx found that the resulting Arbitrum transactions contained empty signature fields, demonstrating that the transfers did not require signatures from the targeted wallet — a mechanism examined in an Ethereum Magicians discussion. The intervention relied on authorized upgrade powers rather than compromising the wallet's cryptographic keys. It also demonstrated that private-key ownership does not guarantee exclusive control over assets on Arbitrum One when governance can alter transaction-processing rules.

The council used the same approach in April to freeze approximately 30,766 ETH linked to the KelpDAO exploit. The Binance-related action marks its second such intervention this year.

Binance Details Months-Long Intrusion

Binance said on November 3, five days after the incident, that the breach affected approximately $6.34 billion, with $2.85 billion frozen or intercepted, according to its official blog post and a post on X. The FBI has attributed the theft to North Korea's TraderTraitor operation.

The exchange traced the campaign to a tampered Homebrew installation downloaded in June and a separate September recruitment scam that persuaded another engineer to download malicious code. Attackers subsequently used compromised devices, an internal AI tool, and stolen credentials to reach wallet-signing infrastructure.

The October 29 transfers included 233.46 million XRP. On Ethereum, malicious EIP-7702 authorizations allowed further transfers outside Binance's normal withdrawal systems, meaning suspending customer withdrawals did not stop every outflow.

Binance said it had allocated more than enough funds to absorb the losses and has replenished 98% of affected tokens, while purchasing the less liquid remainder. It also rebuilt affected systems, replaced compromised devices, and revoked exposed credentials. Those replacement purchases are separate from recovering stolen assets.

Binance is engaging independent cybersecurity firms to review its preliminary findings, while the funds secured through Arbitrum's intervention remain subject to a governance decision. The outcome of the DAO vote and the results of the independent reviews are the next developments to watch.