Arcus pays out 2,234,391 USDG after integer underflow exploit

Arcus, a decentralized exchange running on Robinhood Chain, paid out 2,234,391 USDG to an exploiter after a bug let a freshly created account inflate its own balance.

Security firm CertiK attributes the incident to an integer underflow. That is the kind of math error where a number drops below zero and wraps around into an enormous positive value. Picture an odometer rolling backward past zero and landing on 999,999.

The payouts happened across nine separate BridgeVault transfers to a wallet Arcus has since made public. Damage could have been worse. An on-chain rate limit kicked in early and blocked an estimated $3 million in additional withdrawals.

How the exploit unfolded

The trouble started at roughly 10:07 p.m. ET on November 9, 2026. A newly created account abused flaws in how Arcus handled transfers between subaccounts, which let it pump up its balance well past what it had actually deposited.

The exchange’s own incident report carries the November 9 date. CertiK notes that the relevant ledger activity and on-chain executions landed on November 10 UTC. Late evening on the US East Coast is already the next day in UTC, so both dates describe the same night.

The response timeline, according to the deep research findings, looked like this:

• About 10:10 p.m. ET: the on-chain bridge rate limit engaged
• 10:15 p.m. ET: internal monitoring flagged the activity
• 11:07 p.m. ET: Arcus paused withdrawals across the entire platform
• About 30 minutes after the pause: a fix was deployed
• 4:26 a.m. ET, November 10: withdrawals resumed

Roughly $3 million in withdrawal requests that the rate limit had held up were reversed once the fix went live. The exploiter walked away with the 2,234,391 USDG that had already cleared, and nothing more.

One nuance worth keeping straight: CertiK explicitly says the token count is not an independently valued dollar loss or a measure of attacker profit. The figure describes how many USDG tokens moved. It is not a verified accounting of what anyone gained or lost in dollar terms.

Arcus covers the gap and floats a bounty

Arcus says it covered the shortfall from its company treasury. Per the research findings, no other users’ funds were negatively affected, and operations came back online within hours.

The exchange also went the transparency route. It published the exploiter’s address and is working with blockchain investigators to trace the funds.

There is a negotiation angle too. Arcus reportedly offered the exploiter a bounty in exchange for returning a substantial portion of the tokens. Whether the exploiter has taken the deal remains unknown.

The incident has been characterized as an internal accounting error, not a flaw in smart-contract security.

Background: Arcus and Robinhood Chain

Arcus is a decentralized exchange aligned with the dYdX team, one of the longer-running names in on-chain derivatives trading. It operates on Robinhood Chain and settles payouts in USDG through its BridgeVault.

As of November 13, 2026, there were no reports of broader market contagion tied to the exploit. The damage appears contained to Arcus itself, and the company absorbed it.

What this means

The most instructive detail here is the timeline gap. The bridge rate limit engaged around 10:10 p.m. ET, three minutes into the exploit. The platform-wide pause did not come until 11:07 p.m., nearly an hour after monitoring flagged the problem at 10:15.

During that window, the automated circuit breaker was doing most of the heavy lifting. Without it, the roughly $3 million in blocked requests would likely have joined the 2,234,391 USDG already out the door.

The second lesson concerns where risk actually lives. Audits tend to concentrate on smart contracts, and Arcus’s contracts reportedly were not the weak point. The failure sat in internal accounting logic for subaccount transfers, a layer that is easy to overlook because it feels like bookkeeping rather than security.

Integer underflows are a well-understood class of bug. Their appearance in a production system tied to an experienced team is a reminder that familiar failure modes keep resurfacing wherever arithmetic touches balances.

For traders, the treasury backstop is the reassuring part. Users were made whole and the platform was running again by early the next morning.

The things to watch now are fairly concrete. First, whether the exploiter accepts the bounty and returns a meaningful share of the tokens. Second, whether Arcus publishes a fuller technical postmortem explaining how the underflow slipped through and what checks have been added.

Third, whether other venues on Robinhood Chain review their own bridge rate limits in light of how much this one saved. A three-minute response from an automated limit, versus an hour for the manual pause, makes a fairly persuasive case for automation.