Written by: Shenchao TechFlow
At 08:08 Beijing time on October 30, 2026, the Arbitrum Security Council, without the attacker's private key, transferred 8,425 ETH and 74,559,805.2 ARB from addresses on Arbitrum One associated with the Binance theft case into an address that can only be accessed through an ArbitrumDAO vote. According to Shenchao TechFlow's calculations, these assets were worth approximately $30.45 million at 15:54 Beijing time on November 3, accounting for about 0.48% of Binance's approximately $6.3 billion affected amount.
How the Security Council moved funds without a private key
According to the Arbitrum Security Council forum announcement, the Council performed an atomic upgrade to the Inbox contract on Ethereum: it added a new function, sendUnsignedTransactionOverride, used it to construct two cross-chain transactions impersonating the stolen address, transferred the funds to 0x0000000000000000000000000000000000000DA0, and then restored the Inbox to its original implementation, all completed within the same Ethereum transaction, block 26,301,886, at 00:08:35 UTC on October 30. The announcement stated: "No other users' funds or applications were affected."
According to CoinDesk, the Security Council consists of 12 members elected by ARB holders, and emergency operations require signatures from 9 of them. In an on-chain analysis on the Ethereum Magicians forum, security firm Zealynx wrote that about 10 minutes after the Ethereum transaction executed, two 0x65-type transactions were included on Arbitrum One, with the signature fields r, s, and v all zero, consuming the stolen address's own 2nd and 3rd nonces.
On Arbitrum, whether an address's funds can be moved ultimately depends on the signatures of 9 of the 12-member committee that controls the upgrade path; the private key is only one of the gates. In Zealynx's words, "an address only moves if the private key signs" holds true only beneath those who control the upgrade path.
What was frozen was all of Binance's stolen assets on Arbitrum
According to Shenchao TechFlow's previous on-chain review, between 05:35 and 05:38 Beijing time on October 30, the attacker transferred all of Binance's stolen 8,426 ETH and 74.6 million ARB on Arbitrum into a new wallet starting with 0x3e2b, and the impersonated sender recorded by Zealynx was precisely this address. According to Shenchao TechFlow's calculations, the Security Council acted about 2.5 hours after the funds entered that wallet, freezing all of Binance's stolen assets on this chain.
According to a query by Shenchao TechFlow through an Arbitrum public node, as of 15:54 Beijing time on November 3, the 0DA0 address held 8,426.05 ETH and 74,559,805.2 ARB. Based on CoinGecko prices at the same moment (ETH $2,255.38, ARB $0.1535), the total is approximately $30.45 million.
The April precedent: releasing funds once faced legal obstacles
| Freeze event | Execution time | Frozen assets | Current status |
|---|---|---|---|
| KelpDAO attack | 23:26 US Eastern Time, April 21 | 30,765.67 ETH | Transferred to Aave via DAO vote |
| Binance theft | 08:08 Beijing time, October 30 | 8,425 ETH, 74,559,805.2 ARB | Awaiting DAO vote |
According to the April forum announcement, the ETH frozen that time was likewise transferred to the 0DA0 address, and on April 25, five parties including Aave Labs submitted a proposal requesting its use to compensate rsETH holders. According to CoinDesk, this ETH was worth about $71 million at the time; families holding North Korean terrorism compensation judgments had attempted to claim the money, and only after a Manhattan federal judge modified a restraining order did the DAO vote to transfer the funds to Aave. According to Shenchao TechFlow's calculations, the two freezes total approximately 39,192 ETH.
On October 31, the U.S. Federal Bureau of Investigation (FBI) attributed the Binance theft case to the North Korean hacker group TraderTraitor. The Arbitrum governance forum will hold a proposal discussion at 00:00 Beijing time on November 4; this emergency operation is listed only under "Quick Updates"; as of 16:00 Beijing time on November 3, there was still no proposal on the forum to release these funds.
