2,234,391 USDG Withdrawn from Arcus After Flaw in Withdrawal Logic
Key Facts
A total of 2,234,391 USDG was withdrawn from Arcus Perps after a flaw in the logic for transfers between subaccounts, according to DefiLlama’s page, which recorded the incident on November 10, 2026, and classified it as a protocol logic flaw. The page says the flaw allowed the recorded balance to be inflated and then used to request an asset withdrawal. As a result, the amount withdrawn was not the same as the withdrawal requests that were halted before payout. The page reported additional requests worth $3 million, saying the bridge limit prevented them from being paid and they were later reversed. It also said user balances were unaffected after the company covered the shortfall from its treasury.
According to DefiLlama’s description, the sequence began with subaccount balances: the flaw inflated the recorded balance through transfers between them, and the higher balance was then used to execute the withdrawal. Assets actually withdrawn totaled 2,234,391 USDG, the page said. The $3 million figure relates to additional withdrawal requests that were not paid out, because the bridge’s withdrawal rate limit halted them before they were later reversed. The incident record therefore distinguishes the amount withdrawn from requests the bridge mechanism prevented from being paid. DefiLlama classified the technique used as a flaw in withdrawal logic, while listing the incident under protocol logic flaw.
The page says Arcus fixed the vulnerability and restricted the exploiter’s accounts, then covered the full shortfall from its treasury. It added that user balances remained unaffected. This means, according to the published details, that the company absorbed the recorded shortfall rather than charging it to customer balances. The page did not provide a separate figure for the shortfall after accounting for amounts that were not paid out, so the specific figure for the actual withdrawal remains 2,234,391 USDG. The open details also do not provide a documented timeline for fixing the vulnerability or the timing of any resumption of withdrawals.
The incident follows Arcus’s expansion of multi-asset collateral. In a report published by EL7 on November 6 about a decision dated November 5, the platform was said to have made multi-asset collateral available to all traders and set borrowing at $10,000. This provides earlier context on the product’s development, but the incident record does not link that step to the flaw that led to the withdrawal. DefiLlama data show that Arcus’s total value locked rose from $28.39 million on September 30 to $63.74 million on October 31, 2026. This provides background on the growth in total value locked before the November incident, without the source establishing a causal link between that growth and the flaw.
On next steps, JinaCoin quoted an Arcus report saying the company was working with blockchain investigators to trace the withdrawn funds. It added, according to the same report, that it could coordinate with law enforcement if needed. The quotation did not specify when the tracing would be completed or give a final outcome for the funds. This follow-up remains separate from the flaw remediation that DefiLlama said Arcus had carried out, and from its confirmation that user balances were unaffected. DefiLlama recorded the incident date as November 10, 2026.