Decentralised exchange Arcus has disclosed that an accounting flaw allowed a newly created account to withdraw about $2.23 million, and said its treasury has covered the shortfall in full. The company said no user funds were affected and that trading and withdrawals are operating normally.

Arcus said the flaw sat in how the platform handled transfers between a user's own subaccounts. A newly created account exploited it to record a balance far larger than the funds it actually held, then requested withdrawals against the inflated balance. In total, 2,234,391 USDG, a stablecoin trading at $1.00 at the time, left the platform on-chain before withdrawals were halted.

Timeline of the incident

The first exploit activity began at about 10:07pm ET on 9 November (03:07 UTC on 10 November). Arcus paused platform withdrawals at 11:07pm ET and deployed a fix at 11:37pm ET, within an hour of detecting the problem. Withdrawals resumed at 4:26am ET on 10 November, and Arcus Labs covered the shortfall from its corporate treasury at 12:28pm ET the same day.

The attacker also submitted further withdrawal requests worth about another $3 million. Those requests were blocked by the cross-chain bridge's rate limits, were never paid out, and were later reversed. Arcus said the incident involved a single account and left other users' balances, positions and orders unaffected.

How the flaw worked

Subaccounts let one user split a single profile into separate balances for different trading activity. Arcus said that under certain conditions, moving funds between a user's own subaccounts could record a balance far larger than the account actually held. The newly created account used that gap to request payouts against the inflated figure, and the platform processed some of those requests before the team stopped withdrawals. Arcus said the balance itself was only a ledger entry, but the USDG that left the platform on-chain was real.

The cross-chain bridge's rate limits then capped how much more could move in a set period, which kept the loss to the $2.234 million that had already been withdrawn. Arcus did not give further detail on how those limits are set, or how many blocked requests were involved.

What happens next

Arcus has published the attacker's first address and asked exchanges and service providers to flag any assets linked to it, so other platforms can watch for the funds if they move. The company is working with blockchain investigators to trace the stolen funds, and has not said whether any of the money has been recovered. It has not named the attacker or said whether the person is tied to any known group.

Arcus is a self-custodial trading protocol for stock tokens, crypto assets and perpetual futures, and its platform is unavailable in the United States. The company did not say whether an outside audit of the flaw will follow.