Arcus exploit: perp DEX loses $2.23 million to a sub-account bug

Arcus, a decentralised exchange on Robinhood Chain, lost about $2.23 million in the early hours of November 10, 2026. A newly created account exploited an accounting bug in transfers between sub-accounts, was credited with a balance it never held and withdrew 2,234,391 USDG. According to the operators, only this one account was involved. The balances, positions and orders of all other users were unaffected, and Arcus Labs has covered the shortfall from its own treasury. If you trade there, you will not have to top up your account. A few checks are still worthwhile, because the case shows where the real risk lies on on-chain perpetual exchanges.

Unless stated otherwise, the figures in this article come from the Arcus incident report published on November 10. The data platform DefiLlama lists the incident in its hack database with the same amount and classifies it as a flaw in protocol logic, more precisely in the withdrawal logic.

Arcus exploit: how the night of November 10 unfolded

Arcus gives the times in its report in US Eastern Time. Converted to Central European Time, the sequence is as follows. At about 4:07 a.m. on November 10, the newly created account began moving funds between its sub-accounts. Only three minutes later, at 4:10 a.m., the rate limit kicked in on the bridge that pays out Arcus balances to the blockchain. At 4:15 a.m. the operators’ monitoring raised an alert and the investigation began.

Just under an hour later, at 5:07 a.m., Arcus halted all withdrawals on the platform and posted a notice on its status page. The code fix went live at 5:37 a.m., and by 5:43 a.m. the attacker’s addresses had been blocked from trading, transfers and withdrawals. Normal withdrawals resumed from 10:26 a.m., and at 11:02 a.m. Arcus cancelled the attacker’s outstanding withdrawal requests. By 6:28 p.m. the shortfall had been made good from the company treasury.

That puts roughly 52 minutes between the first alert and the halt of all withdrawals, and a little over 80 minutes until the fix. Arcus itself says the bug was resolved within about an hour of discovery. The report does not explain the gap between the two figures.

Sub-account bug: how a new account was credited with funds it never had

A sub-account is a secondary account within the same wallet. Traders use them to keep strategies apart, for instance one account for a leveraged trade and another for calmer positions, without setting up a new wallet each time. In its documentation Arcus describes the feature as part of its account architecture: balances can be moved between sub-accounts of the same wallet.

This is exactly where the flaw sat. Under certain conditions that Arcus has not specified, the exchange booked a balance after such an internal transfer that was well above the actual holdings. The account then submitted withdrawal requests against this inflated balance, and part of them was executed on the blockchain before the operators stepped in.

Technically, this was neither an attack on a blockchain nor a stolen key. It was an error in the exchange’s own bookkeeping, meaning the software that records who owns how much. The attacker needed no third-party credentials; a freshly created account was enough. Arcus has not yet published a full root-cause report identifying the affected code.

Bridge rate limit: why $3 million stayed on the platform

The damage could have been considerably greater. According to the report, the attacker requested withdrawals of a further $3 million or so. Those requests got stuck in the bridge’s rate limit, were never paid out and were later reversed.

A rate limit is a cap on how much money can leave through a connection within a given period. It works like a lock gate: once the quota is used up, all further withdrawals wait until the time window expires or someone intervenes. At Arcus, this brake gave the operators time to halt the platform before more than about two-fifths of the requested sum had flowed out.

For you as a user, this is a useful test. Platforms with withdrawal limits, round-the-clock monitoring and a public status page are able to contain a bug. Whether an exchange has such mechanisms is usually stated in its documentation or in its security disclosures.

Arcus and Robinhood Chain: who is behind the perp DEX

Arcus is a perp DEX, a decentralised exchange for perpetual futures. Perpetual futures are futures contracts with no expiry date that let you bet with leverage on rising or falling prices without owning the underlying asset. Arcus was developed by the team behind the derivatives exchange dYdX; according to The Block, Robinhood Crypto is a strategic investor.

Arcus went live with the launch of Robinhood Chain in July 2026, initially offering stock tokens that can be traded around the clock. Perpetual markets on equities, commodities, indices and cryptocurrencies followed, which according to The Block initially ran as a beta. USDG, a dollar-pegged stablecoin issued by Paxos, serves as collateral and settlement currency.

An important point for context: the incident does not affect Robinhood Chain itself. Arcus attributes the loss to its own booking logic for sub-accounts. From what is known so far, other applications on the same blockchain are not affected.

Customer funds at Arcus: what cover from the company treasury means

Arcus Labs has covered the shortfall of just over $2.23 million from its own funds. For users, this means first of all that their balances are fully backed. The incident report states explicitly that user balances were not affected.

That is no blanket guarantee. The cover rests on a decision by the company, with no legal obligation or deposit insurance behind it. In the event of a larger failure, any reimbursement would depend on how much money the operators have in the treasury and whether they are willing to pay. That is precisely the difference from a bank account, where statutory deposit protection applies.

The $2.23 million that left the platform has also not been recovered. Arcus says it is working with blockchain investigators, tracing the funds on-chain and intends to coordinate with law enforcement. Arcus has published the attacker’s address and asked exchanges and service providers to flag funds coming from it. Whether any of it can be frozen remains unclear.

If you are looking for a leveraged trading platform regardless of this case, the comparison of the best perp DEXs sets out the security features, audit reports and fees of the largest providers side by side.

Perp DEX risk: the third incident this week after Across and Initia

Arcus is not the only case of recent days. At the Across bridge, attackers used a hijacked domain to steer users to a fake site, as we described in our article on the Across bridge hack. At Initia, a compromised cloud key cost $3.27 million according to the project; the details are in our article on the Initia hack.

The three cases have different causes: a hijacked domain, a stolen key and an accounting bug. What they share is that the underlying blockchain held up in each case, while the infrastructure built on top of it failed. For retail investors, that is the key lesson. The security of a blockchain says little about how secure an application running on it is.

At Arcus, the loss came from the exchange’s bookkeeping. Traditional exchanges with customer accounts carry exactly the same risk; it is simply less visible there, because their bookings do not take place on a public blockchain. One advantage of the decentralised model is that every withdrawal can be traced on the blockchain, including the attacker’s.

How to protect yourself from accounting bugs on perp DEXs

What happened: On November 10, 2026, at about 4:07 a.m. Central European Time, a newly created account on the perp DEX Arcus exploited a bug in transfers between sub-accounts and withdrew 2,234,391 USDG. The bridge rate limit held back a further $3 million or so. According to its own report, Arcus has covered the shortfall from its company treasury (as of November 11, 2026).

Are you affected? According to Arcus, no, if you hold an account there: the balances, positions and orders of other users remained unchanged. Anyone who requested a withdrawal on the night of November 10 had to wait between 5:07 a.m. and 10:26 a.m. because of the halt. Users of other exchanges, and of Robinhood Chain in general, are not affected by this bug.

1. Reconcile your account: Compare balances, open positions and withdrawal requests since November 9 with your own records and report any discrepancies to support@arcus.xyz.
2. Read official notices only: Open the Arcus status page and blog from your own bookmark and do not follow links to supposed refunds from chats, emails or replies on X.
3. Revoke approvals: Use a tool such as Revoke.cash to see which contracts your wallet has approved for USDG and other tokens, and revoke unlimited approvals you do not currently need.
4. Limit trading capital: Keep only the amount on a perp DEX that you need for open positions and their collateral, and move the rest to your own wallet.
5. Ignore unknown tokens: Do not touch unfamiliar tokens or supposed compensation airdrops that turn up in your wallet after the incident, as this scam often follows hacks.

Our guide on how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison sets out suitable devices.

Perpetual futures and MiCA: the protection European traders have

Perpetual futures are derivatives. The EU’s crypto regulation MiCA governs crypto-asset service providers such as exchanges, brokers and custodians, whereas derivatives on crypto assets fall under EU securities law, the Markets in Financial Instruments Directive MiFID II. A decentralised trading venue without an operator in the EU is, as a rule, subject to neither of these regimes. There is therefore no licence from a regulator such as Germany’s BaFin, no obligation to hold client funds separately and no route to file a complaint with a national authority.

If you want to trade with leverage, you have two options. On a perp DEX you keep control of your wallet but bear the risk of errors in the code and in the bookkeeping, as the Arcus case shows. With a regulated provider licensed in the EU, supervision and custody rules apply, and for derivatives there are also leverage caps for retail clients. Our overview of regulated crypto exchanges lists which platforms hold authorisation under MiCA.

Whichever route you choose, one rule applies to leveraged trading: liquidation occurs when the collateral posted no longer covers a position’s losses. The exchange then closes the position by force. If a platform such as Arcus suspends withdrawals, open positions keep running and you cannot top up collateral from outside while the bridge is halted. Keep your safety margin generous for that reason.

Arcus exploit: with no root-cause report, only trading capital belongs

Arcus responded quickly and absorbed the loss itself. Still open are the exact cause, the outcome of the effort to trace the funds and whether independent auditors have since reviewed the code again. Until then, it is sensible to be cautious about how much capital you leave on the platform.

1. Compare platforms: The perp DEX comparison shows which providers can point to audit reports, withdrawal limits and a public status page.
2. Consider a regulated alternative: If supervision and custody rules matter more to you than holding your own wallet, you will find licensed providers among the regulated crypto exchanges.
3. Move long-term holdings out: Whatever you are not actively trading belongs in your own wallet; the hardware wallet comparison shows suitable devices.

(As of November 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)