Arcus Reimburses $2.23M USDG Lost in Subaccount Exploit

Decentralized exchange Arcus reimbursed 2,234,391 USDG after an attacker exploited an accounting flaw in its subaccount system to drain funds at 10:07 p.m. ET on Nov. 9 (03:07 UTC Nov. 10), the platform said.

The exploit targeted how Arcus records funds moving between subaccounts on a single account. The flaw let the account's balance read higher than it should have before a withdrawal went through, according to the company's account of the incident. Arcus said the episode involved one account only — other users' balances, positions and open orders were untouched.

The attacker didn't get away with everything they tried. A separate withdrawal request worth roughly $3 million was blocked by cross-chain bridge limits and later canceled, Arcus said. That limit, not a security control, appears to have capped the damage.

What did Arcus do in response?

The timeline was tight. Arcus paused all withdrawals at 11:07 p.m. ET Nov. 9 (04:07 UTC Nov. 10) — an hour after the exploit executed. Engineers fixed the flaw about 30 minutes later, and the platform reopened withdrawals at 4:26 a.m. ET Nov. 10 (09:26 UTC), roughly five hours after the halt began.

Arcus Labs covered the full 2,234,391 USDG shortfall from company reserves, so no users absorbed a loss. The company said it is working with blockchain investigators to trace the withdrawn tokens and will cooperate with law enforcement if needed.

Why does subaccount bookkeeping matter?

The incident wasn't a smart contract break or a bridge compromise. It sat in Arcus's internal bookkeeping — the ledger logic that tracks transfers between subaccounts under one user. When that record-keeping overstates a balance, a withdrawal can execute against money that was never there.

That distinction matters for how the market should read it. The core trading venue kept operating, and the flaw was patched within roughly 30 minutes of detection. But it also means the failure point was the platform's own accounting layer, which is harder to audit from the outside than on-chain contract code.

For a decentralized exchange holding customer balances across subaccounts, accounting integrity between those sub-venues is as operationally critical as custody itself. A one-account exploit with a clean reimbursement is a contained event; a systemic mispricing across subaccounts would be something else entirely.

The blocked $3 million withdrawal adds a wrinkle. Bridge limits stopped that request, not a detection system, which suggests the attacker's second move failed on throughput constraints rather than being caught and rejected by Arcus's controls.

Arcus hasn't named the blockchain investigators it's working with or detailed how far the traced tokens have moved. The recovery question now rests on those tracing efforts and any law enforcement cooperation the company said it would pursue if needed.