Arcus Perps Exploit on Robinhood Chain: We Followed the $2.23M from Nine Withdrawals to 1,052 ETH, a Million DAI in One Wallet, and 2.83 BTC
BlockintAI · 2026-11-11T15:31:20.479Z
Arcus, a perpetuals and stock-token exchange on Robinhood Chain, published an incident report on November 10, 2026. Arcus says that at about 10:07 PM ET on November 9 (9:07 PM CST), a newly created account used a bug in transfers between a user's own subaccounts to record a balance far larger than it held, and then withdrew against it. Arcus puts the loss at 2,234,391 USDG paid out on-chain. It says another $3 million of requests was held back by the bridge's on-chain rate limit and later reversed, and that Arcus Labs covered the shortfall from its own treasury. Arcus published one address for the exploiter: 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd.
We read that address on Robinhood Chain (chain ID 4663) and on Ethereum, and followed each asset to where it sits now. All times are America/Chicago (CST, UTC−6). Balances are as of about 6:50 AM CST on November 11.
Nine withdrawals, and the rate limit you can see
Every payout came from one contract, 0x4fdbdaf4…15a4, verified on Robinhood Chain under the contract name BoringVault:
| Time (CST, Nov 9) | USDG | Transaction |
|---|---|---|
| 9:08:52 PM | 1 | 0x534b430d8b651bff2849e249cef93cf031af5ac531e4c7272bc6a3a6b3f3ee29 |
| 9:10:15 PM | 500,000 | 0x285333d00a4b553dbc6a325269e4c6fa901c9f3d7cc8cdde4c20f17ac01c4aa0 |
| 9:10:42 PM | 500,000 | 0x16e6e206f0a6700c95ec03d55b3728b34846b08294c6791b88a6a99dcf0c2c2b |
| 9:11:02 PM | 500,000 | 0x71c1bb3a43516bcc2eea3c3f1460ce8f5e139e9535ffd3427ba63dbf46e05005 |
| 9:11:24 PM | 500,000 | 0x0127b0a030550a848bdf583d24e4dc6538f69aaf5b05ec49dd584c4600a59c00 |
| 9:28:14 PM | 55,000 | 0x817d56ed73f97b16c1b0ae1e55bf48ba896e9060bed425ae96579e1c76939629 |
| 9:32:18 PM | 60,000 | 0x458019d994b2ec23786db94cb24261e48526385587bb8d158528fd93c4c43f2b |
| 9:42:08 PM | 58,471 | 0xb4b62e32bec8138bcd14d66c0b8b17a87314843ea8cd49017a22d609581bff6d |
| 9:53:56 PM | 60,919 | 0x2ab936cf849529238ea15e42e0a6d5bcf1b2f27f585bcd9b5ee940fc8523d761 |
The nine add up to 2,234,391 USDG, Arcus's number to the dollar.
The shape matches Arcus's timeline. A 1-USDG test, then four 500,000-USDG payouts in 69 seconds. Arcus says the bridge's rate limit "automatically capped payouts" at 10:10 PM ET, which is 9:10 PM CST. After the fourth large payout, every withdrawal was between 55,000 and 60,919 USDG, spaced 4 to 17 minutes apart. The last one landed at 9:53:56 PM CST. Arcus paused withdrawals platform-wide at 11:07 PM ET (10:07 PM CST), 13 minutes after that.
The account was barely a day old. It received its first gas, 0.091367 ETH, at 11:33:36 PM CST on November 8 from 0x88d25c86…51d3, a wallet active on Robinhood Chain since July. Shortly after midnight it bought 42.36 USDG through Relay and ran small round trips of 1 to 40 USDG: out to one contract, and back from the same BoringVault that later paid the large withdrawals. On the evening of November 9 it traded small amounts of the SPY stock token, starting about 90 minutes before the first large withdrawal.
Out through Relay: 1,052.21 ETH on Ethereum within 44 minutes
Two and a half minutes after the last 500,000 payout, the exploiter started sending USDG into the contract verified as RelayDepository (0x4cd00e38…bc31, the same address Etherscan labels Relay: Depository on Ethereum). Relay's public request API shows each deposit and what it paid out:
| Deposit (CST) | USDG in | Result | ETH out on Ethereum |
|---|---|---|---|
| 9:13:50 PM | 100,000 | paid | 47.122279 |
| 9:16:34 PM | 1,000,000 | paid | 469.569509 |
| 9:20:15 PM | 560,039 | refunded (560,038.996336 USDG back at 9:22:16 PM) | — |
| 9:24:21 PM | 900,028.444314 | paid | 424.870792 |
| 9:29:22 PM | 55,000 | paid | 25.924740 |
| 9:34:46 PM | 60,000 | paid | 28.304202 |
| 9:42:55 PM | 58,471 | refunded (58,470.995205 back at 9:45:29 PM) | — |
| 9:53:25 PM | 58,470.995205 | paid | 27.657497 |
| 9:57:11 PM | 60,919 | paid | 28.763669 |
The exploiter sent the refunded 560,039 USDG back in as part of the 900,028 deposit. In all, 2,234,418.44 USDG crossed, and 1,052.212689 ETH reached 0xeFbf…b3Dd on Ethereum between 9:15:59 PM and 9:59:23 PM CST. Of that, 922.10 ETH came through the contract verified as RelayRouter and 130.11 ETH directly from the address Etherscan labels Relay: Solver. The 1,000,000-USDG deposit is 0x234c2ad2a07af973d64f2ba7184b90169beb68564dd83cc76288641459952613 on Robinhood Chain. Its Ethereum payout is 0xeee44e3ac0140a485eac9c5decc08c9b572f17a6489d5060bd4e1da968333d60. The USDG balance on Robinhood Chain is now zero.
Half sold for DAI, and the DAI parked in one wallet
From 11:34 PM CST on November 9 to 12:20 AM on November 10, the exploiter wrapped ETH and sold 475.901731 WETH in 11 orders settled by CoW Protocol: GPv2Settlement. It got back 1,008,945.41 DAI. The first order is 0x64f1d899b5adf51d4d7c7e55d1a90cc13512db95b33fc8f0d3310456231986f9 and the last 0x24273e146b0335ac4c9396d3eee8ca426446dd3d43134b988dc0e26a0d1f0f09.
On the morning of November 10 it moved the DAI to 0x9a30f6a5…13d0, a fresh address with no transactions of its own. First came a 1,000-DAI test at 7:18:59 AM (0x119ec146add9a9a14f999e983da89070d1aea5df50c23c3c97f05e3e07067bd2), then 100,000 DAI, then 807,945.42 DAI at 7:23:47 AM (0x68852b302e8ea0ef0196cd88ccc72539839ae83e64c0f765485db3bfc443682b), and then 12 smaller transfers until 9:29 AM. 0x9a30…13d0 now holds 1,008,945.42 DAI and has never sent anything. Arcus sent its on-chain message to this address as well as to the exploiter.
2.83 BTC through THORChain and Relay, to one Bitcoin address
The exploiter sent 52.977812 ETH to the contract Etherscan labels THORChain: THORChain Router v4.1.1 in three deposits. Each memo asked for BTC at the same address, bc1qtlme…9wn7:
- 1:20:59 AM, 0.471745 ETH (
0xaa9b8b41da0d7feb7a9e7998ec796aa4eb494da621a8d6d723377e91e179edd3) - 1:43:23 AM, 4.712002 ETH (
0x700862fe820db2534644fd19e457de6fdebd60a95bd292aa3dbe1d71301e2984) - 6:09:59 AM, 47.794065 ETH (
0x43dadfc755273916c59ef128a3addbaeadf06890c89c7d21a357012777dbebd5)
The Bitcoin payouts carry OUT: memos naming those exact Ethereum transactions. They paid 0.01328042 BTC at 1:47 AM, 0.13257994 BTC at 2:42 AM and 1.33063625 BTC at 8:22:48 AM CST.
At 6:18 and 6:20 AM, the exploiter also sent 48.271547 ETH to 0xa91fe480…a3e2, which passed it into Relay seconds later. Relay's API records both requests with the same Bitcoin recipient. They paid 0.01340026 BTC and 1.34119696 BTC at 7:18:05 AM CST, in Bitcoin transactions 8f86416687cbfff99ba7569b62062fa65616e40861d0c18a7f3fece0c567946c and 4aa7cfbb7f6f1e05bb8d715b11bce6a74f4b83a77e29dd9b9093172e42bc057b.
bc1qtlme…9wn7 has received five payments totaling 2.83109383 BTC and has spent none of it. An earlier 0.472-ETH attempt through Chainflip at 12:58 AM was refunded an hour later.
475 ETH has not moved
0xeFbf…b3Dd still holds 475.06 ETH. Its last outgoing transaction was at 9:29 AM CST on November 10. Here is how the 1,052.21 ETH splits up:
| Destination | ETH |
|---|---|
Sold for DAI via CoW Protocol (DAI now in 0x9a30…13d0) |
475.90 |
| THORChain → BTC | 52.98 |
0xa91f…a3e2 → Relay → BTC |
48.27 |
Still in 0xeFbf…b3Dd |
475.06 |
The small remainder went to gas. Another 9.45 ETH was wrapped and then unwrapped again, so it is counted in the 475.06.
The negotiation is happening on-chain
At 7:08:35 PM CST on November 10, 0x604d2124…b8bb sent the exploiter an Ethereum transaction whose data reads, in part: "This message is from the Arcus team." It offers a whitehat deal. Return 90%, "approximately $2,011,000 in ETH, WETH or DAI", keep about $223,000 as a bounty, and Arcus will "not pursue further action". The deadline is November 13, 2026, 01:00 UTC, which is 7:00 PM CST on November 12. The recovery address is the Safe 0x1d4324C84e36D8104BDF327474755E5Aa0cFeBc9. Minutes later the Safe itself sent the exploiter a 1-wei transfer on both chains: 7:23:07 PM CST on Robinhood Chain and 7:24:23 PM CST on Ethereum (0x36626c180029341a89ead3420d8fa56abac8639759db184c78fbf89bd2e651f5). The same message went to the exploiter on Robinhood Chain at 7:09:10 PM CST. Transaction: 0xf37d9b39bb5aa836826e859b27856f6f242c94c8b9bdcfa3123736b193a6a187.
The exploiter has not replied on-chain. The only other note it got came at 12:38 AM CST on November 11, from a stranger asking for "a couple of grand for trade purpose".
Poisoners went after the exploiter
Address-poisoning bots started copying the exploiter's own counterparties within minutes. After the DAI moved, lookalikes beginning 0x9a30 and ending 13d0 sent dust and fake "DAI" tokens. After the ETH moved to 0xa91f…a3e2, lookalikes beginning 0xa91f and ending a3e2 sent fake "ETH" tokens and 1-wei transfers. None of these came from the exploiter's key, and we left them out of every total above.
What to watch
- The deadline: 7:00 PM CST, November 12. A transfer to
0x1d43…ebc9would be the return. - The three holdings: 475.06 ETH in
0xeFbf…b3Dd, 1,008,945.42 DAI in0x9a30…13d0, and 2.83109383 BTC inbc1qtlme…9wn7. DAI cannot be frozen by its issuer. - Users: Arcus says no other account's balance, position or order was affected, and that withdrawals reopened at 4:26 AM ET (3:26 AM CST) on November 10.
Arcus asks exchanges and service providers to flag any funds received from the exploiter's address. If you lost crypto in any exploit or scam, report it to the FBI at ic3.gov and file it at blockint.ai/c3.
Sources
- Arcus, Arcus Incident Report: November 9, 2026, November 10, 2026
- DefiLlama, Arcus protocol page, hacks section (2,234,391 USDG; Nov 10, 2026 UTC)
- Robinhood Chain (chain ID 4663) and Ethereum mainnet, read through the Etherscan API V2: USDG transfers, transactions and contract verification for
0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd, BoringVault0x4fdbdaf4…15a4, RelayDepository0x4cd00e38…bc31 - Relay public request API (
api.relay.link/requests/v2), each deposit transaction above - Etherscan name tags: Relay: Depository, Relay: Solver, CoW Protocol: GPv2Settlement, THORChain: THORChain Router v4.1.1, Chainflip 1 (read 6:44 AM CST, November 11)
- Bitcoin, read through mempool.space:
bc1qtlme…9wn7and the five payout transactions with theirOUT:memos - On-chain message from
0x604d2124…b8bb, Ethereum transaction0xf37d9b39bb5aa836826e859b27856f6f242c94c8b9bdcfa3123736b193a6a187