By Arbitrum’s Security Council executed an emergency intervention on October 30, 2026, transferring approximately $30.5 million in cryptocurrency linked to the Binance security breach into a frozen intermediary wallet.
The action secured 8,425 ETH and 74,559,805.2 ARB held by an address identified as associated with the exploit on Arbitrum One. According to an official statement published on the Arbitrum governance forum, the operation took place at 8:08 a.m. Hong Kong time on October 30.
The assets were transferred to a designated wallet ending in 0DA0, where they remain inaccessible to the original holder. Arbitrum said the funds can only be moved following an ArbitrumDAO governance vote, with subsequent steps coordinated among relevant parties.
The intervention forms part of a broader industry response to the Binance incident, which the exchange estimates affected approximately $6.3 billion in cryptocurrency assets. Binance reported that roughly $3 billion had already been frozen across blockchain networks and token issuers.
Emergency Contract Upgrade Enables Asset Transfer
The Security Council used its emergency authority to temporarily modify Arbitrum’s inbox contract on Ethereum, enabling transactions that transferred the assets without authorization from the address holding them. The inbox contract is part of Arbitrum’s infrastructure for processing messages and transactions originating from Ethereum.
According to the technical disclosure, the council introduced a function called sendUnsignedTransactionOverride, which could reproduce the structure of a cross-chain transaction while impersonating its sender. Two transactions were then constructed to act on behalf of the address associated with the Binance exploit.
These transactions transferred the identified ETH and ARB balances to the intermediary wallet at 0x0000000000000000000000000000000000000DA0. Following execution, the inbox contract was restored to its original implementation.
Arbitrum contributors prepared the transaction payload, which Security Council members verified before signing and executing the operation. The council emphasized that no other users’ funds or applications were affected. The transaction was publicly recorded on Ethereum, providing an auditable record of the intervention.
Although the operation prevented further transfers by the suspected attacker, the assets have not yet been returned to Binance. Their eventual disposition will depend on governance decisions and coordination with the relevant parties.
Intervention Raises Questions About Layer-2 Governance Powers
The action highlights the emergency authority available to governance bodies operating Ethereum layer-2 networks. Unlike a conventional stablecoin freeze, which can be implemented by a token issuer, Arbitrum’s intervention relied on temporary changes to network infrastructure.
The distinction is significant because the secured assets included ETH and ARB rather than exclusively centrally issued stablecoins. It also demonstrates how emergency governance mechanisms can override transaction authorization under exceptional circumstances.
Arbitrum previously exercised similar powers in April 2026, when its Security Council froze approximately 30,766 ETH, worth about $71 million, associated with the KelpDAO exploit. That earlier intervention also transferred assets into a restricted intermediary wallet pending further governance action.
The latest operation follows a much larger attack against Binance, which reported unauthorized withdrawals across multiple blockchain networks on October 29. Blockchain intelligence firm TRM Labs attributed the incident to North Korea’s TraderTraitor operation, although Binance has not publicly confirmed the attackers’ identities.
TRM estimated that stablecoin issuers and Arbitrum together had restricted approximately $2.7 billion in assets during the initial response. Binance subsequently reported approximately $3 billion frozen on-chain and pledged to cover customer losses using its emergency reserve and corporate funds.
The Arbitrum intervention represents a relatively small portion of the total affected assets, but it provides another mechanism for limiting losses beyond issuer-controlled token freezes. It also raises broader questions about the balance between decentralized transaction finality and emergency governance powers.
For now, the $30.5 million remains secured rather than recovered, with its ultimate return dependent on further ArbitrumDAO action.