Decentralized exchange Arcus DEX lost $2.23 million in an exploit on November 9, after an accounting vulnerability allowed an attacker to inflate the recorded balance of a newly created account and withdraw funds that were not actually held in it. The exchange said it has covered the entire shortfall from its treasury and that no other users' balances, positions, or orders were affected.

According to Coin Bureau, which disclosed the incident in an X post, the flaw enabled the exploiter to make the account appear to hold substantially more funds than its actual assets. The discrepancy in the platform's accounting system allowed the attacker to withdraw money the account did not own, resulting in the $2.23 million loss.

Bridge Rate Limit Blocked Additional $3 Million Withdrawal Attempt

The incident could have resulted in a larger loss. The exploiter attempted to withdraw an additional $3 million, but the bridge's on-chain rate limit prevented those payouts from being processed, blocking the funds before they could leave through the bridge. Rate limits on bridges are designed to cap how much value can move through them in a given period, a safeguard intended to limit outflows during an exploit. Combined with the funds already taken, the exploiter sought roughly $5.23 million in total, with the rate limit cutting off more than half of that amount.

The source report did not provide further details about the specific mechanism used to manipulate the account balance or the technical cause of the accounting error.

Arcus Fixed the Vulnerability Within 90 Minutes

Arcus detected and addressed the vulnerability within approximately 90 minutes of the exploit. As part of its response, the platform blocked the addresses associated with the exploiter and temporarily suspended withdrawals.

The measures followed the discovery of the unauthorized withdrawals and were intended to contain the incident while Arcus addressed the accounting flaw and restricted the exploiter's activity.

Treasury Covers the Entire $2.23 Million Shortfall

Arcus said it has since replenished the entire $2.23 million shortfall using funds from its treasury, and reiterated that the incident did not affect other users' balances, positions, or orders. The platform's statement indicates the exploit was limited to the funds taken by the attacker rather than extending to other users' recorded account holdings or trading positions.

Recovery efforts are continuing. The stolen funds are being tracked on-chain, and Arcus is coordinating with blockchain investigators and law enforcement to pursue their recovery. No further details about the recovery process or the identity of the exploiter have been provided.

Source: Hokanews