An accounting bug, not a stolen key — and that’s exactly what makes the Arcus case worth reading.
The facts: Arcus, a DEX built by the team behind dYdX, revealed on Nov 10 that at around 22:07 New York time on Nov 9, a new account exploited a flaw in how the exchange handled transfers between subaccounts. The account recorded a balance far larger than what it actually held, then withdrew 2,234,391 USDG before withdrawals were halted. Around $3 million in other withdrawal requests were held up by the bridge’s rate limit. The flaw was fixed in less than an hour, and Arcus covered the entire shortfall from company funds — user funds were unaffected. The attacker’s initial address was made public so exchanges could flag it. (Arcus’s official incident report, Nov 10; The Block, Nov 11.)
My take: the amount is small compared with the major hacks this year, but the type of flaw is what matters: it wasn’t a leaked private key, but faulty internal accounting. Two things saved the day: the bridge’s rate limit, which held back $3 million, and company funds that covered the shortfall without burdening users. In a market that’s still defensive, this is a reminder that the biggest risk sometimes isn’t the market, but the assumptions built into the code.
What I’m watching: whether the stolen funds can be traced through the published address, and whether other DEXs also re-audit their subaccount logic.
Which safeguard do you think is more important for a DEX: code audits, or withdrawal limits like this?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #DeFi
The facts: Arcus, a DEX built by the team behind dYdX, revealed on Nov 10 that at around 22:07 New York time on Nov 9, a new account exploited a flaw in how the exchange handled transfers between subaccounts. The account recorded a balance far larger than what it actually held, then withdrew 2,234,391 USDG before withdrawals were halted. Around $3 million in other withdrawal requests were held up by the bridge’s rate limit. The flaw was fixed in less than an hour, and Arcus covered the entire shortfall from company funds — user funds were unaffected. The attacker’s initial address was made public so exchanges could flag it. (Arcus’s official incident report, Nov 10; The Block, Nov 11.)
My take: the amount is small compared with the major hacks this year, but the type of flaw is what matters: it wasn’t a leaked private key, but faulty internal accounting. Two things saved the day: the bridge’s rate limit, which held back $3 million, and company funds that covered the shortfall without burdening users. In a market that’s still defensive, this is a reminder that the biggest risk sometimes isn’t the market, but the assumptions built into the code.
What I’m watching: whether the stolen funds can be traced through the published address, and whether other DEXs also re-audit their subaccount logic.
Which safeguard do you think is more important for a DEX: code audits, or withdrawal limits like this?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #DeFi