Arcus Discloses About $2.23 Million Stolen via Accounting Bug, Fully Covers Shortfall From Company Treasury

November 11: Decentralized trading platform Arcus disclosed that on November 10 (Beijing time) it found an accounting bug that allowed a user to withdraw funds they were not entitled to. Arcus detected and fixed the bug within an hour and has covered the entire shortfall. User balances were unaffected, and trading and withdrawals are operating normally.

According to the report, at 11:07 on November 10 (Beijing time), a newly created account exploited a flaw in how the exchange processes transfers between user sub-accounts to record a balance far higher than it actually held and request a withdrawal. Before withdrawals were halted, about $2.234 million in USDG had been withdrawn on-chain, while another $3 million withdrawal request was blocked by the cross-chain bridge's rate limit, was not paid and was later canceled. Arcus Labs has fully covered the shortfall from its corporate treasury, is working with blockchain investigators to trace the funds, and has published the attacker's initial address, asking exchanges and service providers to flag the related funds.