Arbitrum Council freezes 8,425 ETH and 74,559,805.2 ARB after Binance breach
Key Facts
On October 30, the Arbitrum Security Council said it had frozen 8,425 ETH and 74,559,805.2 ARB on Arbitrum One after linking the assets to a breach involving Binance hot wallets. The tokens were placed in an intermediate address and can be moved from it only through an ArbitrumDAO governance vote and in coordination with relevant parties. The funds were therefore not returned to Binance or their owners, although the action stopped them from being moved from the address linked to the incident. The council said funds belonging to other users or applications were not affected by the intervention. The exceptional measure puts the fate of the frozen assets in the hands of the network’s governance.
The council said the freeze was carried out through an atomic operation that involved upgrading the Inbox contract on Ethereum to add a new function simulating a transaction sender. Two cross-chain transactions were created to impersonate the address linked to the attacker, after which the contract was returned to its original execution. The council described the operations as having been created "to impersonate an address linked to the Binance breach." The emergency measure was carried out by the Security Council itself; an ArbitrumDAO vote is required to move the funds later. This differs from returning the assets directly to the platform or their owners, as the council’s announcement covered only freezing them at a specified address.
Binance said its hot wallets were breached on October 29 at 20:05 UTC, and estimated the value of the asset losses at about $6.3 billion. In an update issued on October 30, the platform said about $3 billion of affected assets had been frozen on-chain by that date. Reuters reported that Tether said it had frozen assets linked to the incident worth about $1.57 billion, while Circle said it had frozen more than $800 million. These are figures reported by different parties for assets frozen or recovered, alongside Binance’s estimate of its losses. Reuters noted that Bitcoin fell on October 30 to a six-week low of $76,368, while Ether dropped more than 3% to a two-month low of $2,178 before the market stabilized.
In its next update, Binance said the share of affected assets it had covered rose to 90% by October 31, compared with about 80% in its previous update. It said it had allocated more than $6.34 billion in company funds in the previous update to cover the losses, including $5 billion held in the same assets affected by the breach. The platform said it would bear the financial impact of the stolen funds, adding: "We will continue to buy the remaining tokens through market channels and over-the-counter trading until coverage reaches 100% for all tokens." It added that coverage would rely in part on the SAFU user protection fund and part of the futures insurance fund, alongside the company treasury. It said the remaining about 10% consists of tokens outside the top ten listed assets, and their lower liquidity could extend the time needed to buy the required amounts.
Binance said its initial investigation indicated a possible breach of a DevOps engineer’s laptop, which enabled the attacker to access a service container and send unauthorized withdrawal transactions. It added that it had found no evidence of a wallet private key being compromised. The platform said it would publish further technical details after the investigation was complete and the facts verified. In its October 31 update, it said the proof-of-reserves snapshot was taken at 00:00 UTC, and generating the full proof takes about 40 to 50 hours. It identified resuming withdrawal services as its next step, targeting Sunday, November 1, within the previously announced timeframe.
For the ARB token, EL7 data showed it closed at $0.1675 on October 27 and at $0.1526 on November 3. These prices document daily closes on two different dates during the period around the breach and freeze. The available data does not directly link this price change to the Arbitrum Security Council’s action. On October 30, EL7 published a report on the freeze of the same assets, detailing the quantities announced by the council. Moving the frozen funds remains conditional on an ArbitrumDAO governance vote.