Arbitrum Security Council moves $30M of Binance hack funds without hacker's key

Arbitrum's Security Council used its emergency upgrade powers on October 30, 2026 to move about 74,559,805 ARB and 8,425 ETH — roughly $30 million at prices on the day — out of an address tied to the October 29 Binance hot-wallet hack and into a holding wallet whose address ends in 0DA0. The funds can now only be released by an ArbitrumDAO governance vote. Primary source: Arbitrum's governance forum notice dated 30-10-2026. Coverage: CoinDesk; independent write-up: security firm Zealynx.

What happened

The 12-member Security Council, elected by ARB holders and sitting behind a 9-of-12 Safe multisig, executed the asset movement in one Ethereum transaction. That transaction temporarily replaced the code of Arbitrum's Inbox contract on L1 with a modified version adding a function called sendUnsignedTransactionOverride, then restored the original Inbox code within the same transaction.

According to Zealynx's post-mortem, the funds landed on Arbitrum about 10 minutes later as type 0x65 transactions, with blank signature fields and using the exploiter address's own transaction counter as nonce. In practice, the Security Council forged valid transactions on behalf of the attacker's address by abusing an upgrade path only it controls.

Mechanism — the Inbox contract and the override function

Arbitrum's Inbox contract is the L1 endpoint that forwards messages into the L2 sequencer. The Security Council's upgrade reused the Inbox's privileged position to insert a function that could emit unsigned retryable tickets mimicking any L2 account's next transaction. The attacker's funds moved out of the exploiter address as if that address had itself signed the sweep.

The notice from the Security Council says the move is a custody action, not a confiscation. The holding wallet is a cold address, and the Council has published that transfers from it will require an ArbitrumDAO governance vote co-ordinated with relevant parties — a formula the Council has previously used when U.S. law-enforcement attribution is involved.

Zealynx's summary: the Council "used powers the DAO gave it and published both actions within an hour and a half." The firm's parting line goes to the mechanism's wider implication: the assumption that an on-chain address moves only when its key signs holds only "up to whoever controls the upgrade path."

Numbers

• Addresses touched: Binance-hack-attributed address (not disclosed in forum notice) → holding wallet ending in 0DA0
• Amounts: 74,559,805 ARB + 8,425 ETH
• USD value on Oct 30: ~$30 million (per CoinDesk)
• Share of total Binance hack (~$6.3 billion): under 0.5%
• Mechanism: one L1 Ethereum transaction containing Inbox-contract code replacement, forged-signature L2 transfer, then Inbox-contract restoration
• Signature threshold: 9 of 12 Security Council members
• Attribution of parent hack: FBI, which named TraderTraitor (North Korea) on Oct 31
• Source: Arbitrum governance forum, Oct 30 notice; Zealynx post-mortem

What to watch

1. The ArbitrumDAO governance proposal that will decide the fate of the $30M — whether it goes back to Binance for user restitution, is held in trust, or is distributed otherwise.
2. Zealynx's full disclosure on the type 0x65 transaction crafting and any community audit of the Inbox override.
3. Whether the Arbitrum Foundation publishes a dated, versioned description of sendUnsignedTransactionOverride so that the function can be reviewed, deprecated or restricted.
4. TraderTraitor's response on-chain: whether the attacker tries to accelerate laundering of the funds still under their key, now that they know Arbitrum has demonstrated an off-key path to move L2 assets.
5. Whether other L2s with similar emergency councils — Optimism, Base, Starknet — issue public statements on whether they would use equivalent powers in the same circumstances.

Context

This is the second time the Arbitrum Security Council has used emergency powers to move exploited funds. In April 2026, it froze 30,766 ETH (~$71 million) tied to the KelpDAO exploiter after law-enforcement attribution; the eventual recovery took weeks because of legal challenges, including terrorism-judgment claims against North Korea.

The move sits at the heart of a running debate about L2 custody: the Council was elected by token-holders and uses the exact powers the ArbitrumDAO voted it, but each exercise narrows the gap between an L2 that reads as a smart-contract chain and one whose assets can be re-routed by a nine-signature committee. The Arbitrum team has repeatedly said these powers are reserved for exploits and law-enforcement-attributed thefts; the KelpDAO and now Binance precedents define the fact pattern.

As of Nov 3, 2026, the broader figures on the Binance hack stand around $2.5–3 billion frozen across stablecoin issuers, bridges and exchanges, against a stated loss of $6.34 billion. The Security Council's $30M is a small share, but it is the first case of a decentralised upgrade path being used, rather than a stablecoin issuer's address blocklist, to immobilise attacker funds in this incident.