Arcus Exchange Loses 2,234,391 USDG to Integer Underflow Exploit

An exploiter walked away with 2,234,391 USDG from the Arcus decentralized exchange on the night of November 9, 2026, after abusing an integer underflow in the platform's subaccount transfer logic. Arcus covered the shortfall from its own treasury. No other users' funds were affected, and withdrawals resumed by 4:26 a.m. ET the next morning.

The incident began at roughly 10:07 p.m. ET. A newly created account exploited flaws in how Arcus handled transfers between subaccounts, letting it inflate its balance far beyond what it had actually deposited. The tokens had already cleared through the exchange's BridgeVault, which settles payouts in USDG on Robinhood Chain, before anyone could stop them.

There is a small date discrepancy worth settling. Arcus's own incident report carries the November 9 date. CertiK notes the ledger activity and on-chain executions landed on November 10 UTC. Late evening on the US East Coast is already the next day in UTC, so both dates describe the same night.

How fast did Arcus respond?

The response timeline, reconstructed from deep research findings, shows an automated system reacting far quicker than the humans.

• About 10:10 p.m. ET: the on-chain bridge rate limit engaged
• 10:15 p.m. ET: internal monitoring flagged the activity
• 11:07 p.m. ET: Arcus paused withdrawals platform-wide
• About 30 minutes after the pause: a fix was deployed
• 4:26 a.m. ET, November 10: withdrawals resumed

That hour between the monitoring flag and the manual pause matters. Roughly $3 million in withdrawal requests sat blocked behind the rate limit during the window. Those requests were reversed once the fix went live. The exploiter got away with the 2,234,391 USDG that had already cleared, and nothing more.

One nuance keeps the accounting honest. CertiK explicitly says the token count is not an independently valued dollar loss or a measure of attacker profit. The figure describes how many USDG tokens moved. It is not a verified accounting of what anyone gained or lost in dollar terms.

What does this change for the platform?

Arcus, a decentralized exchange aligned with the dYdX team and one of the longer-running names in on-chain derivatives, chose the transparency route. It published the exploiter's address and is working with blockchain investigators to trace the funds.

There is a negotiation angle too. Arcus reportedly offered the exploiter a bounty in exchange for returning a substantial portion of the tokens. Whether the exploiter has taken the deal remains unknown as of November 13, 2026, the date by which no broader market contagion had been reported. The damage appears contained to Arcus itself, and the company absorbed it.

The incident has been characterized as an internal accounting error, not a flaw in smart-contract security. Arcus's contracts reportedly were not the weak point. The failure sat in internal accounting logic for subaccount transfers, a layer that is easy to overlook because it feels like bookkeeping rather than security.

Integer underflows are a well-understood class of bug. Their appearance in a production system tied to an experienced team is a reminder that familiar failure modes keep resurfacing wherever arithmetic touches balances.

Where does the real lesson sit?

The most instructive detail is the timeline gap. The bridge rate limit engaged around 10:10 p.m. ET, three minutes into the exploit. The platform-wide pause did not come until 11:07 p.m., nearly an hour after monitoring flagged the problem at 10:15.

During that window, the automated circuit breaker did most of the heavy lifting. Without it, the roughly $3 million in blocked requests would likely have joined the 2,234,391 USDG already out the door. A three-minute response from an automated limit, versus an hour for the manual pause, makes a fairly persuasive case for automation.

For traders, the treasury backstop is the reassuring part. Users were made whole and the platform was running again by early the next morning.

The things to watch now are concrete. First, whether the exploiter accepts the bounty and returns a meaningful share of the tokens. Second, whether Arcus publishes a fuller technical postmortem explaining how the underflow slipped through and what checks have been added. Third, whether other venues on Robinhood Chain review their own bridge rate limits in light of how much this one saved.

The strongest signal from this incident is that containment, not prevention, decided the outcome, and venues building on Robinhood Chain now have a live case study arguing for automated limits at the bridge layer.