Arcus exploit: perp DEX loses $2.23M to sub-account bug

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Arcus, a decentralised exchange on Robinhood Chain, lost about $2.23 million in the early hours of November 10, 2026. A newly created account exploited an accounting bug in transfers between sub-accounts, was credited with a balance it never held and withdrew 2,234,391 USDG. According to the operators, only this one account was involved. The balances, positions and orders of all other users were unaffected, and Arcus Labs has covered the shortfall from its own treasury. If you trade there, you will not have to top up your account. A few checks are still worthwhile, because the case shows where the real risk lies on on-chain perpetual exchanges.

Unless stated otherwise, the figures in this article come from the Arcus incident report published on November 10. The data platform DefiLlama lists the incident in its hack database with the same amount and classifies it as a flaw in protocol logic, more precisely in the withdrawal logic.

Arcus exploit: how the night of November 10 unfolded

Arcus gives the times in its report in US Eastern Time. Converted to Central European Time, the sequence is as follows. At about 4:07 a.m. on November 10, the newly created account began moving funds between its sub-accounts. Only three minutes later, at 4:10 a.m., the rate limit kicked in on the bridge that pays out Arcus balances to the blockchain. At 4:15 a.m. the operators’ monitoring raised an alert and the investigation began.

Just under an hour later, at 5:07 a.m., Arcus halted all withdrawals on the platform and posted a notice on its status page. The code fix went live at 5:37 a.m., and by 5:43 a.m. the attacker’s addresses had been blocked from trading, transfers and withdrawals. Normal withdrawals resumed from 10:26 a.m., and at 11:02 a.m. Arcus cancelled the attacker’s outstanding withdrawal requests. By 6:28 p.m. the shortfall had been made good from the company treasury.

That puts roughly 52 minutes between the first alert and the halt of all withdrawals, and a little over 80 minutes until the fix. Arcus itself says the bug was resolved within about an hour of discovery. The report does not explain the gap between the two figures.

Sub-account bug: how a new account was credited with funds it never had

A sub-account is a secondary account within the same wallet. Traders use them to keep strategies apart, for instance one account for a leveraged trade and another for calmer positions, without setting up a new wallet each time. In its documentation Arcus describes the feature as part of its account architecture: balances can be moved between sub-accounts of the same wallet.

This is exactly where the flaw sat. Under certain conditions that Arcus has not specified, the exchange booked a balance after such an internal transfer that was well above the actual holdings. The account then submitted withdrawal requests against this inflated balance, and part of them was executed on the blockchain before the operators stepped in.

Technically, this was neither an attack on a blockchain nor a stolen key. It was an error in the exchange’s own bookkeeping, meaning the software that records who owns how much. The attacker needed no third-party credentials; a freshly created account was enough. Arcus has not yet published a full root-cause report identifying the affected code.

Bridge rate limit: why $3 million stayed on the platform

The damage could have been considerably greater. According to the report, the attacker requested withdrawals of a further $3 million or so. Those requests got stuck in the bridge’s rate limit, were never paid out and were later reversed.

A rate limit is a cap on how much money can leave through a connection within a given period. It works like a lock gate: once the quota is used up, all further withdrawals wait until the time window expires or someone intervenes. At Arcus, this brake gave the operators time to halt the platform before more than about two-fifths of the requested sum had flowed out.

For you as a user, this is a useful test. Platforms with withdrawal limits, round-the-clock monitoring and a public status page are able to contain a bug. Whether an exchange has such mechanisms is usually stated in its documentation or in its security disclosures.

Arcus and Robinhood Chain: who is behind the perp DEX

Arcus is a perp DEX, a decentralised exchange for perpetual futures. Perpetual futures are futures contracts with no expiry date that let you bet with leverage on rising or falling prices without owning the underlying asset. Arcus was developed by the team behind the derivatives exchange dYdX; according to The Block, Robinhood Crypto is a strategic investor.

Arcus went live with the launch of Robinhood Chain in July 2026, initially offering stock tokens that can be traded around the clock. Perpetual markets on equities, commodities, indices and cryptocurrencies followed, which according to The Block initially ran as a beta. USDG, a dollar-pegged stablecoin issued by Paxos, serves as collateral and settlement currency.

An important point for context: the incident does not affect Robinhood Chain itself. Arcus attributes the loss to its own booking logic for sub-accounts. From what is known so far, other applications on the same blockchain are not affected.

Customer funds at Arcus: what cover from the company treasury means

Arcus Labs has covered the shortfall of just over $2.23 million from its own funds. For users, this means first of all that their balances are fully backed. The incident report states explicitly that user balances were not affected.

That is no blanket guarantee. The cover rests on a decision by the company, with no legal obligation or deposit insurance behind it. In the event of a larger failure, any reimbursement would depend on how much money the operators have in the treasury and whether they are willing to pay. That is precisely the difference from a bank account, where statutory deposit protection applies.

The $2.23 million that left the platform has also not been recovered. Arcus says it is working with blockchain investigators, tracing the funds on-chain and intends to coordinate with law enforcement. Arcus has published the attacker’s address and asked exchanges and service providers to flag funds coming from it. Whether any of it can be frozen remains unclear.

If you are looking for a leveraged trading platform regardless of this case, the comparison of the best perp DEXs sets out the security features, audit reports and fees of the largest providers side by side.

Perp DEX risk: the third incident this week after Across and Initia

Arcus is not the only case of recent days. At the Across bridge, attackers used a hijacked domain to steer users to a fake site, as we described in our article on the Across bridge hack. At Initia, a compromised cloud key cost $3.27 million according to the project; the details are in our article on the Initia hack.

The three cases have different causes: a hijacked domain, a stolen key and an accounting bug. What they share is that the underlying blockchain held up in each case, while the infrastructure built on top of it failed. For retail investors, that is the key lesson. The security of a blockchain says little about how secure an application running on it is.

At Arcus, the loss came from the exchange’s bookkeeping. Traditional exchanges with customer accounts carry exactly the same risk; it is simply less visible there, because their bookings do not take place on a public blockchain. One advantage of the decentralised model is that every withdrawal can be traced on the blockchain, including the attacker’s.

How to protect yourself from accounting bugs on perp DEXs

What happened: On November 10, 2026, at about 4:07 a.m. Central European Time, a newly created account on the perp DEX Arcus exploited a bug in transfers between sub-accounts and withdrew 2,234,391 USDG. The bridge rate limit held back a further $3 million or so. According to its own report, Arcus has covered the shortfall from its company treasury (as of November 11, 2026).

Are you affected? According to Arcus, no, if you hold an account there: the balances, positions and orders of other users remained unchanged. Anyone who requested a withdrawal on the night of November 10 had to wait between 5:07 a.m. and 10:26 a.m. because of the halt. Users of other exchanges, and of Robinhood Chain in general, are not affected by this bug.

Reconcile your account: Compare balances, open positions and withdrawal requests since November 9 with your own records and report any discrepancies to [email protected].
Read official notices only: Open the Arcus status page and blog from your own bookmark and do not follow links to supposed refunds from chats, emails or replies on X.
Revoke approvals: Use a tool such as Revoke.cash to see which contracts your wallet has approved for USDG and other tokens, and revoke unlimited approvals you do not currently need.
Limit trading capital: Keep only the amount on a perp DEX that you need for open positions and their collateral, and move the rest to your own wallet.
Ignore unknown tokens: Do not touch unfamiliar tokens or supposed compensation airdrops that turn up in your wallet after the incident, as this scam often follows hacks.

Our guide on how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison sets out suitable devices.

Perpetual futures and MiCA: the protection European traders have

Perpetual futures are derivatives. The EU’s crypto regulation MiCA governs crypto-asset service providers such as exchanges, brokers and custodians, whereas derivatives on crypto assets fall under EU securities law, the Markets in Financial Instruments Directive MiFID II. A decentralised trading venue without an operator in the EU is, as a rule, subject to neither of these regimes. There is therefore no licence from a regulator such as Germany’s BaFin, no obligation to hold client funds separately and no route to file a complaint with a national authority.

If you want to trade with leverage, you have two options. On a perp DEX you keep control of your wallet but bear the risk of errors in the code and in the bookkeeping, as the Arcus case shows. With a regulated provider licensed in the EU, supervision and custody rules apply, and for derivatives there are also leverage caps for retail clients. Our overview of regulated crypto exchanges lists which platforms hold authorisation under MiCA.

Whichever route you choose, one rule applies to leveraged trading: liquidation occurs when the collateral posted no longer covers a position’s losses. The exchange then closes the position by force. If a platform such as Arcus suspends withdrawals, open positions keep running and you cannot top up collateral from outside while the bridge is halted. Keep your safety margin generous for that reason.

Arcus exploit: with no root-cause report, only trading capital belongs

Arcus responded quickly and absorbed the loss itself. Still open are the exact cause, the outcome of the effort to trace the funds and whether independent auditors have since reviewed the code again. Until then, it is sensible to be cautious about how much capital you leave on the platform.

Compare platforms: The perp DEX comparison shows which providers can point to audit reports, withdrawal limits and a public status page.
Consider a regulated alternative: If supervision and custody rules matter more to you than holding your own wallet, you will find licensed providers among the regulated crypto exchanges.
Move long-term holdings out: Whatever you are not actively trading belongs in your own wallet; the hardware wallet comparison shows suitable devices.

(As of November 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about Arcus

On November 10, 2026, a newly created account exploited an accounting bug in transfers between sub-accounts and withdrew 2,234,391 USDG. The bridge rate limit held back a further $3 million or so.

According to Arcus, no. The balances, positions and orders of other users remained unchanged, and Arcus Labs covered the shortfall from its company treasury.

No. Arcus attributes the loss to its own booking logic for sub-accounts and not to a flaw in Robinhood Chain.

A perp DEX is a decentralised exchange for perpetual futures, which are futures contracts with no expiry date used to bet with leverage on rising or falling prices.

Derivatives on crypto assets are covered by EU securities law rather than MiCA. A decentralised trading venue without an operator in the EU is, as a rule, not subject to supervision by any EU regulator.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Section: All crypto hacks and scams at a glance

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Binance Hack, Then a Stock Market Crash: Coincidence or Connection?

The largest crypto theft in history on Thursday evening, Wall Street's worst day since June on Friday. Are the Binance hack and the stock market crash connected? Our analysis of timeline, sizes and money flows, and where crypto and stocks really meet.

October 30, 2026 3:44 PM

$6.5 billion in October: the infrastructure failed, not the smart contract

An in-house count of DefiLlama's hack register for October 2026 finds 32 incidents with $6.5 billion in losses. 99.5 percent of that flowed out through compromised infrastructure, while smart contract flaws cost less than $16 million.

October 30, 2026 1:50 AM

Binance Hack On-Chain Analysis: 50 Signatures, 197,460 ETH and $2.83 Billion Frozen

What really happened in the Binance hack? We analyzed the blockchain ourselves: 50 signatures in one transaction, $2.83 billion frozen, 197,460 ETH with the attacker and an Aave trick. Plus the key voices from X and our conclusion.

October 29, 2026 9:54 PM

Biggest Crypto Hack Ever? Binance Joins the List of Exchange Hacks

At about $2.8 billion the suspected Binance hack would be the largest theft a crypto exchange has ever suffered. The biggest crypto hacks at a glance, why exchanges are hit more often, what Tornado Cash has to do with it and what past cases meant for prices.

October 29, 2026 9:40 PM

Crypto Crash After Binance Hack: $628 Million Liquidated in One Hour

At 20:24 UTC a Binance hot wallet was drained of about $2.8 billion. Within an hour Bitcoin fell below $79,000 and BNB lost 6.3%. Here is the minute-by-minute timeline, the prices of all major coins and what could come next as Asia wakes up.

October 19, 2026 7:37 PM

Cysic halts the bridge: ten million CYS with no backing, 6.22 percent more in circulation

On October 17 an attacker created ten million CYS with no backing through the Cysic bridge; 76 minutes later the foundation blacklisted the address, and 7.2 million tokens were already gone. The bridge remains switched off, and for holders of wrapped tokens the case reframes one question.

October 15, 2026 7:29 AM

17 of 20 top coins down, Ethereum at $2,380: where the sell-off is measured

Ether loses 5.41 percent over 24 hours and falls to a daily low of $2,332.43. Our own count of the 25 largest cryptocurrencies shows how broadly the sell-off really carries.

October 13, 2026 10:18 PM

Papertrade loses $1.28 million on launch day: the reference price came from Hyperliquid

The perpetuals venue Papertrade launched on October 10 with leverage of up to 1,000 and drew its execution prices from the Hyperliquid order book. One trader moved the Ether price there by around three dollars and took between $1.28 million and $1.54 million out of the liquidity pool, according to several trade publications.

October 13, 2026 10:26 AM

Hyperliquid falls 5.9 percent while Bitcoin loses 0.8: $1.66 billion of leverage sits on HYPE

HYPE drops to $82.61 while Bitcoin gives up only 0.8 percent. An own survey of the exchange shows why: $1.66 billion of open leveraged positions stand against $611 million of daily turnover.

October 12, 2026 7:17 PM

Crypto Futures Tax in Germany: 25 Percent From the First Trade, No One-Year Rule

Crypto futures and perpetuals fall under Section 20 of the German Income Tax Act and therefore a flat 26.375 percent, with no holding period and no 1,000-euro exemption. Since the Annual Tax Act 2024, losses on them can again be offset without limit.

October 11, 2026 1:37 PM

Hyperliquid (HYPE): $14.58 Million From USDC Earnings Flows Into the Buybacks, and What to Watch Now

Since the start of October, Hyperliquid has paid for its HYPE buybacks not only out of trading fees but also out of the earnings on its USDC reserves. The first payment came to around 14.58 million USDC, while the price sits 13 percent below its record.

October 5, 2026 10:24 AM

$6 million out of a Base vault: what you can do now with your DeFi deposits

A vault on Base was drained of around 1,783 wstETH on October 4, 2026, about $6 million. The route ran through an entry on the permission list, not through a hole in Aave's protocol.

October 2, 2026 4:32 AM

NEAR Intents halts withdrawals after a $3.8 million exploit: here are the reasons

NEAR Intents confirms an exploit of more than $3.8 million and holds deposits and withdrawals on eleven networks. Reimbursement is promised, a date for it is not.

October 1, 2026 4:21 AM

Velocity Replaces Drift After the 285 Million Dollar Hack: What Changes for Investors in Germany

The Solana perp DEX Drift is back as Velocity, and since September 29, 2026 a new team has been running it. What the overhaul after the outflow of 285 million dollars means for your deposits, for settlement in USDT and for the legal position in Germany.

September 30, 2026 10:24 PM

$766 Million Lost to Crypto Hacks in One Month: What It Means for Your Custody

CertiK counts around $766.4 million in damage for September 2026, the highest monthly figure of the year. Two incidents carry more than 92 percent of it, and both hit a place where your balance could be sitting too.

September 30, 2026 10:13 PM

Robinhood Announces Perp Futures With 10x Leverage for US Customers: “Markets don’t work without traders”

Robinhood plans to offer eligible US customers perpetual futures on eight cryptocurrencies, with up to 10x leverage on Bitcoin and Ethereum. Nothing is tradable yet, and a different leverage cap applies in Europe.

September 30, 2026 4:25 PM

Shiba Inu price 4.9 percent below the month high: Why SHIB is falling

Shiba Inu trades at $0.00000581 on Wednesday afternoon, 4.9 percent below the high of September 23, even though the coin is up 17.0 percent over 30 days. The reasons are not in the chart but in the network data and in the cost structure of trading.

September 29, 2026 7:12 PM

MEXC Refunds $340,000: The Attacker's API Key Survived the Account Freeze

During an account takeover at MEXC, an attacker created an API key with withdrawal rights that the exchange did not revoke when it restored the account. Twenty-seven minutes after the withdrawal freeze expired, roughly $340,000 was gone.

September 29, 2026 10:14 AM

Bitget discloses the flaw at its supplier and sets out the timetable for withdrawals

Bitget has disclosed how the attackers reached its withdrawal systems on September 24: through a previously unknown flaw in a security product it had bought in. The second stage of the withdrawal schedule opens today at 08:00 UTC, and for the balance you keep on any exchange the case changes the arithmetic.

September 28, 2026 4:31 PM

Robinhood Chain After September 29: What the End of Free Gas Changes for the Stock Chain

The Robinhood Chain holds $1.02 billion and more trading volume than Polygon, carried by a meme token launchpad. The gas subsidy ends on September 29, fees are already falling, and this is what the ecosystem of Pons, Uniswap and tokenised stocks really rests on.

September 13, 2026 10:12 PM

Chainflip Hack on Tron: How to Check Whether Your USDT Swap Is Still Stuck

An attacker drained 736,442 USDT through Chainflip's Tron rail on September 12, 2026, and trading has been at a standstill ever since. On September 13 we measured for ourselves which functions of the protocol are switched off and which are still running.

August 31, 2026 4:12 AM

Cronos chain halt: how a Tectonic exploit emptied the chain's largest lending market

On August 30, 2026, the validators of the Cronos chain halted block production after an attacker had emptied the lending market Tectonic via an inflated TONIC price. What is established, why the damage figures diverge, and what you can check if your balance sits on a haltable chain.

August 30, 2026 1:22 AM

Ajna Exploit: $775,400 Drained and No Pause Button in the DeFi Lending Protocol

Between August 28 and 29, 2026 roughly $775,400 drained out of seven Ethereum pools of the lending protocol Ajna v2. Because the contract is immutable and has no governance, there is no pause button: users have to withdraw themselves.

August 22, 2026 10:39 AM

Maya Protocol Exploit: MAYAChain Is Halted, What to Check Now on Cross-Chain Swaps

On August 18, 2026 an attacker drew roughly $1.65 million out of MAYAChain's liquidity pools through six chained faults, and the team then halted the chain globally. Anyone who swapped or provided liquidity there can check in a few minutes whether their own money is stuck in the halted system.

August 6, 2026 1:00 PM

$42 Million in Eight Days: Why ‘Decentralised’ Stopped Protecting Perp DEX Traders

Ostium and AFX were drained inside eight days – both times through keys, not smart contracts. The seven questions you must answer before any deposit.

July 24, 2026 1:25 PM

AFX Trade Hack: Arbitrum Perp DEX Loses $24M as Bridge Keys Are Compromised

AFX Trade lost $24.15M USDC after attackers compromised its bridge validator keys. The perp DEX offered the hacker a 30% bounty to return it.

July 24, 2026 1:09 PM

Ostium Hack: Perp DEX Loses $23.75M in Oracle Key Exploit, Resumes Trading July 23

Ostium lost $23.75M USDC after a compromised oracle signer key let attackers fake prices. The Arbitrum perp DEX reopened trading on July 23.