⚠️ ALERT: $2.23 MILLION drained from Arcus DEX after accounting bug allows exploiter to inflate account balance
Arcus DEX suffered a $2.23 million exploit on November 9 after an accounting bug allowed a newly created account to record a balance far larger than its actual holdings and withdraw funds it never owned.
The exploiter also attempted to withdraw another $3 million, but the bridge's on-chain rate limit blocked the payouts before they were processed.
Arcus detected and fixed the vulnerability within roughly 90 minutes, blocked the exploiter's addresses and temporarily paused withdrawals.
The company has since covered the entire $2.23 million shortfall from its treasury, stating that no other user balances, positions or orders were affected.
The stolen funds are being tracked on-chain, with Arcus coordinating with blockchain investigators and law enforcement to pursue recovery.
Arcus DEX suffered a $2.23 million exploit on November 9 after an accounting bug allowed a newly created account to record a balance far larger than its actual holdings and withdraw funds it never owned.
The exploiter also attempted to withdraw another $3 million, but the bridge's on-chain rate limit blocked the payouts before they were processed.
Arcus detected and fixed the vulnerability within roughly 90 minutes, blocked the exploiter's addresses and temporarily paused withdrawals.
The company has since covered the entire $2.23 million shortfall from its treasury, stating that no other user balances, positions or orders were affected.
The stolen funds are being tracked on-chain, with Arcus coordinating with blockchain investigators and law enforcement to pursue recovery.
