Decentralized Trading Platform Arcus Exploited Due to Vulnerability, Approximately $2.23 Million Withdrawn

On November 11, according to an Arcus incident report, the decentralized trading platform Arcus was targeted by an exploit utilizing an account accounting vulnerability, with approximately $2.234 million worth of USDG withdrawn on-chain. Arcus Labs has fully covered the shortfall from its corporate treasury, user balances remain unaffected, and trading and withdrawal operations are functioning normally.

The report states that around 11:07 Beijing Time on November 10, a newly created account exploited a processing flaw in transfers between user sub-accounts to artificially inflate balances and request withdrawals. Additionally, withdrawal requests totaling approximately $3 million were blocked by cross-chain bridge limits, were not actually disbursed, and have been reversed.

Arcus stated that the team patched the vulnerability within one hour of detecting the anomaly and is collaborating with on-chain investigators to trace the withdrawn funds.