Arcus Offers Attacker $223,000 Bounty to Return $2.23 Million in Stolen USDG

Arcus, a self-custodial trading platform, has offered the attacker behind a $2.23 million withdrawal a bounty of roughly $223,000 — 10% of the stolen funds — to return the remaining 90% by 8 p.m. ET on Nov. 12 (01:00 UTC Nov. 13). The offer, made public by the company, frames a timely repayment as a white-hat recovery, and Arcus pledged to take no further action if the funds arrive before the deadline.

What are the terms of the deal?

Under the proposed arrangement, the attacker would return approximately $2.011 million and keep the remaining 10% as a bounty. Arcus will accept repayment in Ether (ETH), wrapped Ether (WETH) or DAI. The deadline is fixed: 8 p.m. ET on Nov. 12.

The structure follows a now-familiar playbook in decentralized finance, where exploited protocols trade a portion of lost funds for the attacker's cooperation and a public commitment not to pursue legal or on-chain countermeasures. Whether the attacker accepts remains the open question; the company has not disclosed what steps it would take if the deadline passes without repayment.

How did the exploit work?

The withdrawal involved 2,234,391 Global Dollar (USDG) and stemmed from an accounting flaw between subaccounts on the platform. Arcus covered the $2.23 million shortfall from its own treasury, and the company stated that other users' balances, positions and orders were unaffected.

That treasury reimbursement is the operative fact for users: the platform absorbed the loss rather than socializing it across customers. It also means the bounty offer, if accepted, would claw back roughly $2.011 million of the treasury's outlay — at the cost of about $223,000, or one cent per ten cents recovered.

For context, $2.23 million is roughly nine times the size of the bounty Arcus is willing to forgo. The math suggests the company values a guaranteed partial recovery over an uncertain pursuit of the full amount.

What is Arcus?

Arcus operates a self-custodial platform supporting trading in stock tokens, crypto assets and perpetual futures. The company does not offer the platform in the United States, a jurisdictional restriction worth noting given the regulatory sensitivity of tokenized equities.

The platform's self-custodial design may limit its exposure to similar incidents, since users retain control of their assets. The subaccount accounting flaw, however, sat within Arcus's own bookkeeping layer — the component the company directly controls.

What happens next?

The deadline of 8 p.m. ET on Nov. 12 now defines the timeline. If the attacker returns roughly $2.011 million in ETH, WETH or DAI by then, Arcus has committed to treating the episode as a white-hat recovery and taking no further action. If the deadline passes, the company's options — and its willingness to discuss them — remain unstated.