The Arbitrum Security Council moved 8,425 ETH and 74.6 million ARB from an exploit-linked wallet into an address ending in 0DA0 during an emergency action on October 30. The operation used an Inbox override that allowed the network to accept transactions appearing to come from the exploiter, without using the exploiter’s private key.

According to the Security Council’s emergency action disclosure, the move was executed at 8:08 a.m. Hong Kong time. The council said that no other users’ funds or applications were affected. Press estimates valued the frozen assets at nearly $30 million, compared with approximately $6.3 billion that Binance says was withdrawn from its wallets.

The funds can leave the 0DA0 address only through an ArbitrumDAO governance vote. The action therefore involved three separate powers: the council could not sign transactions for the exploiter’s wallet, but it could change how Arbitrum One accepts transactions. Deciding who ultimately receives the assets remains the responsibility of the DAO and, as an earlier freeze demonstrated, may also involve a U.S. court.

How the Inbox override worked

Messages from Ethereum reach Arbitrum One through the Inbox contract on Ethereum mainnet. Under normal conditions, a cross-chain transaction carries the identity of its sender, preventing one Ethereum account from using the standard route to act as another account on Arbitrum.

For the emergency action, the council upgraded the Inbox with a function called sendUnsignedTransactionOverride. The disclosure described the function as adding “the ability to impersonate the transaction sender.” Two messages created with the function identified the exploit address as the sender and directed its ETH and ARB to the holding address. The council then restored the original Inbox code.

The upgrade, transfers and restoration all took place within one Ethereum transaction at 00:08:35 UTC. Arbitrum One processed the result roughly 10 minutes later, and the ARB transfer settled at 00:18:20 UTC. The relevant transaction is recorded on Etherscan, while the corresponding Arbitrum transaction appears on Arbiscan.

Combining the upgrade and restoration in a single transaction can conceal the change from monitoring systems that compare the Inbox implementation address before and after each block. Such a watcher would see the same implementation on both sides of the transaction. Security firm Zealynx flagged this issue in a technical reconstruction published through Ethereum Magicians.

The upgrade remains visible in the contract’s upgrade events and in the transaction execution trace. No cryptography was broken: the attacker’s private key remained under the attacker’s control, while the council changed which sender the network would accept.

What the ARB transaction reveals

The ARB transfer itself looks similar to an ordinary wallet transaction. The exploit address appears in the “from” field, and the address ending in 0DA0 appears in the “to” field. The significant detail is the transaction type, recorded as 101, or 0x65. Arbitrum uses that type for an unsigned transaction that entered from Ethereum.

The exploit address did not produce a signature because this route did not require one. As a result, tools that interpret every outgoing transfer as a decision made by the wallet owner could incorrectly attribute the movement to the exploiter. Wallet-labeling services, compliance-screening systems and explorer summaries could all record the exploiter as having moved the funds, even though the council initiated the action.

From the token contract’s perspective, the event also looked ordinary. Zealynx noted that the ARB contract recorded a standard transfer and had no way to distinguish the council’s action from a normal transfer. The transaction type alone is not conclusive, because Ethereum accounts legitimately use unsigned transactions to reach Arbitrum from mainnet. The distinguishing evidence is the Ethereum message behind the transaction and whether the Inbox implementation changed during that same transaction.

The same mechanism was used in April

The Binance-related freeze followed a mechanism used on April 21, when the council transferred 30,766 ETH from the KelpDAO exploiter after an attack on KelpDAO’s rsETH bridge route. That action used the same function and the same holding address, according to the April emergency-action disclosure.

The authority comes from the ArbitrumDAO constitution, which gives the DAO and the Security Council chain-owner privileges on Arbitrum One. Those privileges include control over core contract upgrades and system settings. Nine of the council’s 12 members can approve an emergency action without a delay.

The constitution limits that authority to genuine security emergencies and requires a transparency report afterward. ArbitrumDAO can also narrow or remove the powers through a constitutional proposal.

Stablecoin freezes operate at a different layer. Circle and Ripple froze tokens connected to the Binance theft using controls built into their respective assets. Coindoo has reported on how the attacker bypassed those controls by borrowing ETH against stolen stablecoins. ETH has no issuer that can blacklist it, but ETH on Arbitrum One is recorded in a ledger whose underlying system the council can upgrade. The October disclosure does not state whether the frozen ETH came from those loans.

The April action prompted debate over the scope of the impersonation capability. Robby Greenfield of Tokedex wrote that it was “not scoped to recovery.” Delegate MconnectDAO asked the council to publish an emergency-action policy defining when it could bypass governance. Delegate deakeegroup took the opposing position, arguing that pre-authorized, narrowly scoped emergency powers were preferable to having no emergency path or relying on unrestricted administrative keys without accountability. On October 11, a participant in the same discussion was still asking whether work on such a policy had started.

For asset holders on Arbitrum One, the episode separates two questions: who controls the private key, and who can change the rules under which that key operates. On Arbitrum One, the latter power rests with nine of the 12 council signers, subject to the constitution. Chains built with Arbitrum technology have separate answers because each chain has its own administrators.

Moving the funds requires another vote

The October disclosure did not identify the final recipient. It said only that a governance vote would be required to move the assets and that the process was being coordinated with relevant parties. The April recovery provides an example of how that process can work.

On April 25, Aave Labs, KelpDAO, LayerZero, EtherFi and Compound published a Constitutional AIP. The proposal named a recovery multisig as the recipient, linked the ETH to restoring rsETH’s backing and committed Aave Labs to indemnify the Arbitrum Foundation, Offchain Labs and council members.

The proposal gave the following schedule:

• Forum discussion: one week
• Snapshot temperature check: one week
• Delay after onchain submission: three days
• Onchain vote: 14 days, extendable to 16
• Arbitrum waiting period: eight days
• Arbitrum-to-Ethereum message finalization: typically at least one week
• Ethereum waiting period: three days

The authors estimated that the process would take about 49 days from posting to execution.

A court subsequently changed the proposed recipient. Plaintiffs in Kim v. Democratic People’s Republic of Korea, who hold an unpaid U.S. judgment against North Korea, had served a restraining notice on “Arbitrum DAO.” A federal order filed May 8 allowed an onchain vote to send the frozen ETH to a wallet controlled by Aave LLC. It also bound Aave LLC to the restraint once it received the funds and reserved every other question concerning the assets.

The proposal was amended to name Aave LLC as the recipient and appeared among Arbitrum’s active onchain votes by May 26, according to the governance roundup. During that debate, delegate DZack23 wrote that even removing the discussion and temperature-check stages would leave at least 35 days. In his view, using another emergency action to accelerate a release would violate the constitution because the speed of a recovery is not itself a security emergency.

The Binance funds carry an attribution similar to that associated with the KelpDAO ETH. TRM Labs and Chainalysis have linked the Binance theft to North Korean hackers, as reported by BleepingComputer. Binance has said it will cover customer losses from its own funds, making the claimant in this case a single exchange rather than the coalition of protocols involved in the April recovery.

The next steps would be visible in three records: a release proposal on the Arbitrum governance forum naming a recipient, the transparency report required by the constitution for the October action, and any court filing identifying the balance held at the 0DA0 address, which is listed on Arbiscan. Arbitrum’s November 3 open governance call was the first scheduled proposal discussion since the freeze. If the release follows the April process, that schedule would establish the earliest point at which the funds could move, while a restraining notice could change the recipient before then.