Arbitrum Security Council Freezes Cryptocurrency After Binance Hack

The Arbitrum Security Council transferred 8,425 ETH and 74,559,805.2 ARB, linked to the Binance hack, to a storage address ending in 0DA0. According to Arbitrum's notification, the emergency action took place at 08:08 Hong Kong time on October 30. Further movement of these funds requires a vote by ArbitrumDAO: freezing and choosing a recipient are two separate decisions.

How it worked

For the operation, the inbox contract in Ethereum was temporarily modified by adding the sendUnsignedTransactionOverride function: it could simulate a cross-chain transaction on behalf of the sender. Two messages transferred ETH and ARB from the attacker's address to the storage address. After this, the original contract implementation was restored in the same atomic operation – the temporary function ceased to be active, but the council's authority to approve updates remained.

Emergency actions by the council require approval from 9 out of 12 members – a 75% threshold. With 3 members unavailable, all remaining 9 are needed; with 4, the threshold is unattainable.

Context

Arbitrum has used this scheme before: in April, the council froze 30,765.67 ETH linked to the KelpDAO hack. Releasing these assets required a separate vote and was then complicated by legal claims from creditors related to terrorist lawsuits, which argued that these assets could be used for court judgments against North Korea. In May 2026, a vote passed with strong support for the return plan and indemnification provisions for executors. This does not mean that Binance's funds will face the same legal procedure: applicable documents and court decisions must specifically indicate the assets and parties involved.

According to the notification, the Binance hack began on October 29 around 20:05 UTC, and the freeze occurred approximately 4 hours and 3 minutes later. The interval is counted from the start of the theft, not from the moment the council received the signal.