Arcus Perps (November 2026) hack — November 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | November 10, 2026 |
| Target type | Decentralised exchange |
| Loss | $2,234,391Price at time of incident |
| Method | Contract logic errorTransfers between subaccounts of the same wallet could, under conditions Arcus has not published, record a balance far larger than the account held; withdrawals were then accepted against that balance |
| Chains | Other |
| Outcome | Users reimbursed |
What happened
Arcus, a perpetual futures and tokenised-stock exchange on Robinhood Chain, lost 2,234,391 USDG on the night of 9 to 10 November 2026. From about 03:07 UTC on 10 November (10:07 pm US Eastern on 9 November), a newly created account exploited a bug in how the exchange handled transfers between a user's own subaccounts: under specific conditions the account recorded a balance far larger than it held, and it withdrew against that balance. A further $3 million of requested withdrawals was held back by the bridge's on-chain rate limit, never paid out, and later reversed; it is not counted here.
Arcus paused withdrawals at 04:07 UTC, deployed a fix at 04:37 UTC and blocked the exploiter's addresses at 04:43 UTC. Withdrawals reopened at 09:26 UTC, and at 17:28 UTC Arcus Labs covered the shortfall from its company treasury. Arcus says only one account was involved and no other balances, positions or orders were affected. Robinhood Chain is not a separate chain value in this registry.
The treasury payment is compensation, not recovery: the withdrawn USDG is still with the exploiter, whose first address Arcus published. On 11 November an on-chain message purportedly from Arcus offered the exploiter a bounty for returning 90% of the funds by 13 November; Arcus's own report does not mention it.
On-chain references
Published so the figures above can be checked against the chain rather than taken from us. Victim addresses are never listed.
Attacker addresses
- 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd
Sources
- Arcus incident report (10 November 2026)Primary · retrieved 2026-11-11
- Arcus on X (10 November 2026)Primary · retrieved 2026-11-11
- The Crypto Times (11 November 2026)Secondary · retrieved 2026-11-11
- DeFi Prime (11 November 2026)Secondary · retrieved 2026-11-11
Official post-mortem: https://arcus.xyz/blog/arcus-incident-report-november-9-2026
Changes to this entry
- Added at Arcus's own figure of 2,234,391 USDG withdrawn on-chain; the $3m held by the bridge rate limit is excluded. Outcome users-reimbursed: the treasury covered the shortfall. Watch the purported 90% bounty offer (deadline 13 Nov) — a return would go in recoveredUsd.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Arcus Perps (November 2026) hack — November 2026", iTokenly, accessed 2026-11-11, https://itokenly.com/hacks/arcus-perps-november-2026https://itokenly.com/hacks/arcus-perps-november-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.