Arbitrum Moves $30 Million Linked to Binance Hack Without Private Key

For the second time this year, a 12-person committee briefly altered one of Arbitrum’s core contracts to spend funds from an unkeyed address before the original code was restored.

Last Friday, Arbitrum’s Security Council transferred over 8,425 ETH and 74 million ARB out of a wallet tied to the Binance hack, while no action was taken by the attacker.

At current market rates, that amounts to roughly $30 million—a mere fraction when it is compared against the nearly $6.3 billion stolen from Binance.

Arbitrum operates as a layer-2 network designed to lower Ethereum transaction fees while securing billions in user deposits. On any blockchain, funds move strictly when signed off by a private key—a secret key that is known only to the wallet’s owner.

Elected by ARB token holders, the 12-member Security Council retains emergency authority to modify network contracts whenever nine members reach an agreement.

On Friday, the council deployed those emergency powers in an unexpected manner. One key Ethereum transaction was executed by the group’s shared Safe wallet, temporarily swapping out the code for Arbitrum’s Inbox contract—the gateway carrying messages from Ethereum.

The temporary update introduced a new function called sendUnsignedTransactionOverride, allowing the council to initiate transactions that were treated by Arbitrum as originating directly from the exploiter’s wallet.

A pair of transactions transferred both the ARB and ether to a storage wallet ending in 0DA0, before the original Inbox code was restored within that very same transaction block, per the council’s governance forum update.

“No other user’s funds or applications were affected,” the notice said. The funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.”

Arbitrum Council Uses Network Authority to Move Funds Without a Signature#

Tracking the activity, security firm Zealynx reported that the assets landed on Arbitrum roughly 10 minutes post-Ethereum transaction as type 0x65 transfers with empty signatures, which were processed using the exploiter account’s original transaction sequence numbers.

The council “exercised authority granted by the DAO and disclosed both operations inside ninety minutes,” the security team noted, emphasizing that the rule requiring a signature to transfer wallet assets is dictated strictly by whoever controls the network’s code updates.

That represents a major caveat for a platform marketing itself as decentralized, implying that whoever governs the code upgrade path can force any address on Arbitrum to be drained at will.

The council has executed a similar maneuver in the past. Back in April, the team transferred 30,766 ETH—then valued around $71 million—from the KelpDAO hacker after the attacker was identified by law enforcement agencies.

Recovering that ether from the storage wallet dragged on for weeks. Families holding unpaid terrorism judgments against North Korea attempted to seize the funds, requiring a Manhattan federal judge to alter a court order before a vote could be held by the DAO to route the assets into Aave.

Federal investigators linked the Binance breach directly to the nation’s TraderTraitor group on October 31, as confirmed by official FBI reports.