Arcus Covers $2.23M USDG Loss From Subaccount Accounting Flaw

Arcus Labs absorbed a $2.23 million shortfall in Global Dollar (USDG) after an accounting flaw allowed a newly created account to withdraw more than it held from the protocol's Robinhood Chain trading platform, according to on-chain records and the company's incident disclosure.

The exploit did not involve a smart contract drain or a compromised key. It exploited the way Arcus recorded internal transfers. The account moved funds between its own subaccounts, and the accounting logic recorded a balance larger than the account actually held. On that inflated ledger entry, the account withdrew 2,234,391 USDG on-chain.

The attempted extraction was larger than the realized loss. A bridge limit blocked roughly $3 million in additional withdrawal requests. Those requests were never paid out, and Arcus later reversed them. Without that limit, the total exposure would have been more than double what was lost — a point practitioners will read as evidence that layered withdrawal controls, not perfect accounting, contained the damage.

What was the timeline?

The incident unfolded quickly and the response was faster:

• Exploit activity began around 10:07 p.m. ET on Nov. 9 (03:07 UTC Nov. 10).
• Arcus paused platform-wide withdrawals at 11:07 p.m. ET — exactly one hour after the first malicious activity.
• A fix was deployed at 11:37 p.m. ET, thirty minutes later.
• Withdrawals resumed at 4:26 a.m. ET on Nov. 10, roughly five hours after the pause.
• Arcus Labs covered the shortfall from its treasury at 12:28 p.m. ET.

For context, one hour from first exploit signal to a global withdrawal halt is a compressed window by the standards of recent DeFi incidents, where detection-to-pause gaps have stretched to many hours or days. The five-hour total outage is roughly what a major exchange schedules for routine maintenance.

What does this change for users?

The incident involved a single account. Balances, positions and orders of all other users were unaffected, and Arcus states that explicitly. Arcus Labs is tracking the withdrawn USDG on-chain, which means the funds remain visible and potentially recoverable through tracing, exchange freezes or law enforcement — the standard playbook for stablecoin outflows of this size.

The treasury coverage matters for one practical reason: users bore no loss and no socialized reduction. Arcus, the operator, absorbed the $2.23 million entirely. That is the difference between a contained operational incident and a solvency event for a trading protocol.

Why the internal-transfer design failed

The mechanism deserves attention from anyone building subaccount architecture. Self-custodial platforms frequently let a single user manage multiple subaccounts — for isolating positions, managing collateral or separating strategies. The flaw here was that transfers between subaccounts under common ownership were not reconciled atomically against the account's true holdings. The ledger credited the receiving side without correctly netting the sending side, leaving a phantom balance that could be withdrawn as real USDG.

Arcus is a self-custodial trading protocol offering stock tokens, crypto assets and perpetual futures. The platform is unavailable in the United States, which places it outside the direct reach of American retail regulators but does not insulate it from the operational scrutiny that follows any six-figure on-chain loss.

The open question is recovery. Arcus is tracking the funds on-chain, and any follow-up — a freeze at a bridge, an exchange block or a negotiated return — will determine whether the $2.23 million treasury outlay is temporary or permanent.