Integer Underflow Exploit Drained 2,234,391 USDG From Arcus

Decentralized exchange Arcus paid out 2,234,391 USDG to an exploiter after an integer underflow bug let a newly created account inflate its own balance, according to an analysis by security firm CertiK. The payouts ran through nine separate BridgeVault transfers on Robinhood Chain, and an on-chain bridge rate limit blocked roughly $3 million in additional withdrawals before the damage grew larger.

CertiK attributes the incident to an integer underflow, a class of arithmetic error where a value drops below zero and wraps around into a huge positive number. The trouble began at roughly 10:07 p.m. ET on November 9, 2026, when a fresh account abused flaws in how Arcus handled transfers between subaccounts and pushed its balance far beyond what it had deposited.

How did the response unfold?

The timeline, reconstructed from Arcus's incident report and CertiK's findings, shows automated defenses reacting faster than humans:

• About 10:10 p.m. ET: the on-chain bridge rate limit engaged, three minutes into the exploit
• 10:15 p.m. ET: internal monitoring flagged the activity
• 11:07 p.m. ET: Arcus paused withdrawals platform-wide
• Roughly 30 minutes after the pause: a fix was deployed
• 4:26 a.m. ET on November 10: withdrawals resumed

The roughly $3 million in requests the rate limit had held back were reversed once the fix went live. The exploiter kept the 2,234,391 USDG that had already cleared, and nothing more. Arcus's incident report carries the November 9 date, while CertiK notes the ledger activity and on-chain executions landed on November 10 UTC — the same night, given that late evening on the US East Coast is already the next day in UTC.

One caveat CertiK makes explicit: the token count is not an independently valued dollar loss or a measure of attacker profit. It describes how many USDG tokens moved, not a verified accounting of gains or losses in dollar terms.

Who covered the losses?

Arcus says it covered the shortfall from its company treasury. Per the research findings, no other users' funds were affected and operations were back online within hours. The exchange published the exploiter's wallet address and is working with blockchain investigators to trace the funds. It has also reportedly offered the exploiter a bounty in exchange for returning a substantial portion of the tokens; whether that deal gets accepted remains unknown.

The incident has been characterized as an internal accounting error rather than a smart-contract flaw. Arcus is aligned with the dYdX team, one of the longer-running names in on-chain derivatives, and settles payouts in USDG through its BridgeVault on Robinhood Chain.

What does the timeline gap reveal?

The most instructive detail is the delay between detection and action. Monitoring flagged the activity at 10:15 p.m. ET, yet the platform-wide pause didn't arrive until 11:07 p.m. — nearly an hour later. During that window the automated circuit breaker did most of the work. Without it, the blocked $3 million in requests would likely have joined the 2,234,391 USDG already out the door.

The second lesson is about where risk actually lives. Arcus's smart contracts reportedly weren't the weak point. The failure sat in internal accounting logic for subaccount transfers — a layer that feels like bookkeeping rather than security and is easy to overlook. Integer underflows are a well-understood bug class; their appearance in a production system tied to an experienced team shows familiar failure modes keep resurfacing wherever arithmetic touches balances.

As of November 13, 2026, there were no reports of broader market contagion tied to the exploit, and the damage appears contained to Arcus itself. What to watch next is concrete: whether the exploiter accepts the bounty, whether Arcus publishes a fuller technical postmortem, and whether other venues on Robinhood Chain review their own bridge rate limits in light of how much this one saved.