Arcus Perps exploit (Nov 9, 2026): 2,234,391 USDG withdrawn on Robinhood Chain via subaccount-transfer accounting bug
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Incident date: 2026-11-09
- Reported: 2026-11-11
- Last updated: 2026-11-11
Arcus, a perpetuals exchange on Robinhood Chain, says a newly created account exploited a bug in how the exchange handled transfers between a user's own subaccounts at around 10:07 PM ET on Nov 9, 2026. Under specific conditions the bug let the account record a balance far larger than it held, and it then requested withdrawals against that inflated balance. Exploiter address (initial, published by Arcus on Robinhood Chain): 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd Impact: 2,234,391 USDG was withdrawn on-chain before withdrawals were stopped. A further $3M of requested withdrawals was held…