CoinDesk
Arbitrum’s 12-member Security Council moved more than 8,425 ETH and 74 million ARB, worth about $30 million, from an address linked to the Binance exploit without the attacker’s signature. The assets are now in a holding address and can move only through an ArbitrumDAO governance vote.
Why it matters
The council used emergency upgrade powers that require approval from nine of its 12 members. It temporarily replaced the code in Arbitrum’s Inbox contract with a function that let the network process transactions as if they came from the exploiter’s address, then restored the original code in the same transaction. The council said no other users’ funds or applications were affected.
The episode highlights a trade-off for a network that presents itself as decentralized: emergency controls can help recover stolen assets, but the upgrade path can also override the usual requirement that a wallet’s private key authorize a transfer. Security firm Zealynx said the council used powers granted by the DAO and disclosed both actions within 90 minutes, while noting that control of the upgrade path can override the assumption that only a keyholder can move funds.
Market impact
The $30 million recovery is small beside the roughly $6.3 billion taken from Binance, but it is the second time this year the council has used its powers to move funds from an exploiter’s address. In April, it recovered 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker.
That earlier recovery took weeks to clear: claims by families holding unpaid terrorism judgments against North Korea led a Manhattan federal judge to modify a restraining notice before the DAO could vote to send the ETH to Aave. The latest funds remain subject to a governance vote and coordination with relevant parties.
Frequently asked questions
-
How did Arbitrum’s council move funds without the wallet’s private key?
It temporarily changed the Inbox contract using emergency upgrade powers, allowing transactions to be processed as if they came from the exploiter’s address, then restored the original code.
-
How many council members approved the emergency action?
The 12-member Security Council’s emergency powers require approval from nine members.
-
Where are the recovered ETH and ARB now?
The assets are in a holding address and can be moved only through an ArbitrumDAO governance vote, coordinated with relevant parties.
-
Why does the recovery raise questions about decentralization?
The council’s control of the upgrade path let it override the usual requirement for a wallet’s private key to authorize a transfer, although it acted under powers granted by the DAO.
-
What happened after Arbitrum’s earlier recovery from the KelpDAO exploiter?
The 30,766 ETH recovery faced legal delays. A Manhattan federal judge modified a restraining notice before the DAO could vote to send the funds to Aave.
Crypto News
Lookonchain
WuBlockchain
Altcoin Daily
CryptoSlate
WatcherGuru
TheBlock