Verify a decision

{"actor":"system:backfill","investigation_id":"2ad23071-c6d7-4995-89c3-a6f1c0c0e50c","kind":"publish","page_slug":"arcus-perps","published_at":"2026-11-14T20:11:25.587Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Arcus Perps","sections":[{"content":"On the night of November 10, 2026 (local European time; approximately 11:07 p.m. Eastern on November 9 in US time), an account on Arcus Perps exploited an accounting bug in transfers between sub-accounts of the same wallet. A newly created account was credited with a balance it never actually held and withdrew approximately 2,234,391 USDG, roughly $2.23 million. The same account reportedly attempted to withdraw an additional $3 million, which was blocked by a bridge rate limit and later reversed, so it was never paid out. Arcus's monitoring flagged the activity roughly 4-8 minutes after the exploit began, withdrawals were halted about an hour later, a code fix was deployed shortly after, and the attacker's address was blocked from further trading and withdrawals. Normal withdrawals resumed several hours later the same morning. Arcus has stated the bug was an error in its own bookkeeping logic rather than a blockchain-level flaw or a compromised key, and that only one account was involved, but it has not published a detailed root-cause report identifying the specific affected code.","heading":"November 2026 Accounting Bug and Fund Loss","severity":"high","sources":[{"credibility":2,"name":"Arcus exploit: perp DEX loses $2.23 million to a sub-account bug - CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/arcus-exploit-perp-dex-sub-account-bug/"},{"credibility":2,"name":"Arcus Covers Approximately $2 Million Shortfall From Treasury After Fixing Accounting Bug","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/arcus-covers-2-million-shortfall-after-accounting-bug"}]},{"content":"Arcus Labs covered the roughly $2.23 million shortfall out of its own company treasury rather than confirming it had clawed back the funds from the account that withdrew them, and it stated user balances, open positions and orders were unaffected by the incident. As of the most recent reporting, the withdrawn funds had not been recovered; Arcus said it was working with blockchain investigators, tracing the funds on-chain, and intended to coordinate with law enforcement, and it published the attacker's address publicly and asked exchanges and other service providers to flag incoming funds from it. Analysts covering the incident have noted that treasury-funded reimbursement is a discretionary business decision by the company rather than a legal guarantee or form of deposit insurance, meaning depositors have no assurance a future incident would be handled the same way. Arcus has also not disclosed whether the withdrawal was a deliberate, intentional exploit or an opportunistic action by a user who discovered the flaw, nor has it said whether it intends to pursue legal action or further recovery efforts against that user.","heading":"Treasury Coverage and Unresolved Recovery","severity":"high","sources":[{"credibility":2,"name":"Arcus exploit: perp DEX loses $2.23 million to a sub-account bug - CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/arcus-exploit-perp-dex-sub-account-bug/"},{"credibility":2,"name":"Arcus Covers Approximately $2 Million Shortfall From Treasury After Fixing Accounting Bug","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/arcus-covers-2-million-shortfall-after-accounting-bug"}]},{"content":"As of the most recent reporting, Arcus had not published a full technical post-mortem explaining the precise mechanics of the sub-account accounting flaw, nor had it disclosed whether independent security auditors reviewed the affected code before or after the incident. News coverage has noted a discrepancy between Arcus's public statement that the bug was resolved within about an hour of detection and incident timelines reconstructed by reporters showing roughly 80 minutes elapsed between detection and the fix going live, a gap Arcus has not explained. The absence of a detailed disclosure leaves open questions about whether the same class of accounting error could recur elsewhere in the protocol's sub-account or collateral-transfer logic, particularly given that the incident occurred shortly after a multi-asset collateral rollout earlier in November 2026, a timing coincidence reporters have flagged without Arcus confirming or denying a causal link.","heading":"Lack of Public Post-Mortem and Audit Transparency","severity":"medium","sources":[{"credibility":2,"name":"Arcus exploit: perp DEX loses $2.23 million to a sub-account bug - CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/arcus-exploit-perp-dex-sub-account-bug/"},{"credibility":2,"name":"Arcus Covers Approximately $2 Million Shortfall From Treasury After Fixing Accounting Bug","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/arcus-covers-2-million-shortfall-after-accounting-bug"}]},{"content":"Arcus is a decentralized exchange offering perpetual futures and tokenized stock trading, incubated by the team behind dYdX Labs and now operating as a separate company. Robinhood Crypto made an undisclosed investment in Arcus, and the platform launched on Robinhood Chain, Robinhood's Arbitrum-based layer-2 network, in mid-2026. The dYdX Foundation has stated that the original, community-owned dYdX blockchain is unaffected and that Arcus is not deployed on dYdX Chain, operating instead as a standalone product on Robinhood Chain; this separation drew some community concern about implications for the dYdX token and ecosystem. Arcus later launched a pToken protocol allowing traders to tokenize managed perpetual accounts as ERC-20 tokens. According to DefiLlama, Arcus Perps reported approximately $65.3 million in total value locked as of late October 2026, though a related DefiLlama listing for the broader Arcus product shows a lower figure, and it is unclear which snapshot is most current. One review has noted that the platform restricts access from the US, UK and Canada despite requiring KYC.","heading":"Background: Origins, Backing and Launch","severity":"low","sources":[{"credibility":2,"name":"Robinhood-backed DEX Arcus debuts multi-asset trading - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/robinhood-backed-dex-arcus-debut-multi-asset-trading"},{"credibility":2,"name":"Arcus goes live after year-long development with dYdX team - CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/arcus-dex-launch-dydx-robinhood/"},{"credibility":2,"name":"Arcus Perps - DefiLlama","type":"research","url":"https://defillama.com/protocol/arcus-perps"},{"credibility":2,"name":"dYdX's Arcus Launches on Robinhood Chain, Sparking Community Concerns - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/dydx-s-arcus-launches-on-robinhood-chain-sparking-community-concerns"}]}],"sources_used":[{"credibility":2,"name":"Arcus exploit: perp DEX loses $2.23 million to a sub-account bug - CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/arcus-exploit-perp-dex-sub-account-bug/"},{"credibility":2,"name":"Arcus Covers Approximately $2 Million Shortfall From Treasury After Fixing Accounting Bug","type":"news_article","url":"https://pro.edgex.exchange/en-US/news/article/arcus-covers-2-million-shortfall-after-accounting-bug"},{"credibility":2,"name":"Arcus accounting bug, treasury covers shortfall - CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/arcus-accounting-bug-treasury-covers-shortfall/"},{"credibility":2,"name":"Robinhood-backed DEX Arcus debuts multi-asset trading - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/robinhood-backed-dex-arcus-debut-multi-asset-trading"},{"credibility":2,"name":"Arcus goes live after year-long development with dYdX team - CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/arcus-dex-launch-dydx-robinhood/"},{"credibility":2,"name":"Arcus Perps - DefiLlama","type":"research","url":"https://defillama.com/protocol/arcus-perps"},{"credibility":2,"name":"dYdX's Arcus Launches on Robinhood Chain, Sparking Community Concerns - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/dydx-s-arcus-launches-on-robinhood-chain-sparking-community-concerns"},{"credibility":2,"name":"Arcus DEX Exploit: How an Accounting Bug Allowed Hackers to Drain $2.23 Million - CoinEdition","type":"news_article","url":"https://coinedition.com/arcus-dex-exploit-how-an-accounting-bug-allowed-hackers-to-drain-2-23-million/"}],"summary":"Arcus Perps is a perpetual futures and tokenized-stock decentralized exchange built by the dYdX team, backed by an undisclosed Robinhood Crypto investment, and operating on Robinhood Chain (an Arbitrum-based layer 2). In November 2026 the protocol lost approximately $2.23 million to an accounting bug in its sub-account transfer logic, which Arcus covered from its own treasury without confirming recovery of the funds or publishing a full technical post-mortem. As of this writing, the exact mechanics of the bug, whether the withdrawal was a deliberate exploit, and whether further user funds remain exposed to similar risk are unresolved.","timeline":[{"date":"2026-11","date_original":"2026-11-05","event":"Arcus rolled out a multi-asset collateral feature; the rollout window ran November 5-7, 2026, shortly before the accounting bug was exploited.","source":"CryptoBriefing","source_url":"https://cryptobriefing.com/arcus-accounting-bug-treasury-covers-shortfall/"},{"date":"2026-11-10","date_evidence":"Night of November 10, 2026: The exploit began at about 4:07 a.m.","event":"An account exploited an accounting bug in Arcus's sub-account transfer logic, withdrawing approximately 2,234,391 USDG (~$2.23 million); Arcus detected the activity within minutes, halted withdrawals, deployed a fix, blocked the attacker's address, and resumed normal withdrawals the same morning.","source":"CryptoTicker","source_url":"https://cryptoticker.io/en/arcus-exploit-perp-dex-sub-account-bug/"},{"date":"2026-11","date_original":"2026-11-10","event":"Arcus covered the approximately $2.23 million shortfall from its own company treasury; the withdrawn funds had not been recovered from the account as of this report.","source":"edgeX News / pro.edgex.exchange","source_url":"https://pro.edgex.exchange/en-US/news/article/arcus-covers-2-million-shortfall-after-accounting-bug"}]},"v":1}