Key Highlights
- The Arbitrum Security Council revealed an emergency rescue of 74,559,805 ARB and 8,425 ETH, worth roughly $30.5 million, from an address linked to the Binance exploit.
- The council used a temporary atomic upgrade to the Ethereum inbox contract to impersonate the transaction sender for cross-chain transfers, then restored the original implementation.
- Earlier, Tether and Circle froze more than $2.3 billion in the joint action. Some analytics firms have linked attack patterns to North Korean-linked actors.
On October 30, the Arbitrum Security Council announced an emergency action to rescue 74,559,805 ARB and 8,425 ETH held at an Arbitrum One address linked to the Binance exploit.
According to the post shared on X, the Arbitrum council identified and executed a technical approach to move the funds to safety without affecting any other chain state or other users. As of October 30, 2026, the funds have been successfully transferred to a frozen intermediary wallet. They are no longer accessible to the original address and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance.
Arbitrum Takes Emergency Measure to Freeze Stolen Funds
The frozen assets consist of approximately 74.56 million ARB tokens and 8,425 ETH. On-chain records confirm the transfer to the address 0x0000000000000000000000000000000000000DA0 on Arbitrum One. The original holding address now shows a zero balance for these assets.
The Security Council used an atomic action, which temporarily upgraded the inbox contract on Ethereum to add a function allowing impersonation of the transaction sender for cross-chain transfers, moved the funds, and then restored the original contract implementation. This ensured no direct impact on the network.
The emergency transaction on Ethereum has the hash 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6. The value of the secured assets is estimated at around $30.5 million based on prevailing market prices at the time of the action.
Binance and partners have reported that the overall verified frozen amount from the broader incident has risen, with Arbitrum’s intervention contributing to recovery efforts alongside freezes by stablecoin issuers.
Binance Shares Details in Initial Investigation
Binance, the world’s largest cryptocurrency exchange by trading volume, reported a major security incident on October 29, 2026, with an estimated total impact of around $6.3 billion. The breach involved unauthorized withdrawals from multiple hot wallets across several chains, including Ethereum, Bitcoin, Tron, and others.
Binance’s initial investigation indicated that a compromised DevOps engineer’s laptop may have allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The exchange stated it found no evidence of any wallet private key leak. Deposits and withdrawals were temporarily suspended while security teams secured infrastructure and traced assets, working with law enforcement and industry partners.
Binance confirmed it will cover all losses using its Secure Asset Fund for Users and company funds, emphasizing that user funds remain safe. Co-founder Changpeng Zhao and co-CEO Yi He publicly affirmed the commitment to make users whole.
Blockchain analytics firms, including TRM Labs and Chainalysis, have linked patterns in the attack to North Korean-linked actors such as TraderTraitor, associated with the Lazarus Group, though investigations continue.
Earlier, Tether froze over $1.5 billion in USDT, Circle froze more than $800 million in USDC, and other parties, including Ripple and World Liberty Financial, contributed additional freezes. Binance reported verified frozen assets reaching approximately $2.54 billion to $3 billion, with the figure subject to increase as tracing continues. Some assets remain with attacker-controlled addresses.
On-chain analysis revealed quick movement of funds shortly after the initial drains, with the attacker using mechanisms such as EIP-7702 authorizations in some cases.
Cyberattacks Mount Across the Crypto Sector
The Binance incident is part of a series of major security breaches affecting crypto platforms in 2026. In September, Bitget reported a $387.5 million loss from hot and warm wallets after attackers exploited a zero-day vulnerability in a third-party security product. Bitget covered the losses from its own funds and restored its protection fund. Investigators linked elements of that attack to North Korean actors.
On the same day as the Binance reports, prediction market platform Polymarket temporarily halted trading on its international venue after a third-party provider was compromised. Attackers used malicious JavaScript to drain approximately $2.7 million from hundreds of user accounts. Polymarket stated it would make affected users whole.
