Arcus, a decentralized exchange operating on Robinhood Chain, paid out 2,234,391 USDG tokens to an exploiter after a bug allowed a newly created account to artificially inflate its balance. Security firm CertiK attributed the incident to an integer underflow—a mathematical error where a number wraps around to an enormous positive value when it drops below zero.
The exploit occurred around 10:07 p.m. ET on November 9, 2026, when the attacker manipulated flaws in how Arcus handled transfers between subaccounts. An automated bridge rate limit engaged three minutes later, blocking an estimated $3 million in additional withdrawals. The payouts occurred across nine separate BridgeVault transfers to a wallet that Arcus subsequently made public.
Timeline and Response
Internal monitoring detected the suspicious activity at 10:15 p.m. ET. Arcus paused all platform withdrawals at 11:07 p.m. ET and deployed a fix approximately 30 minutes later. Withdrawals resumed at 4:26 a.m. ET on November 10. The $3 million in withdrawal requests held by the rate limit were reversed once the fix went live.
CertiK noted that the token count represents the number of USDG tokens transferred, not an independently verified dollar loss or measure of attacker profit.
Company Response and Recovery
Arcus covered the shortfall from its company treasury and reported that no other users' funds were negatively affected. The exchange published the exploiter's address and is working with blockchain investigators to trace the funds. Arcus reportedly offered the exploiter a bounty in exchange for returning a substantial portion of the tokens.
The incident has been characterized as an internal accounting error rather than a flaw in smart-contract security. As of November 13, 2026, there were no reports of broader market contagion tied to the exploit.
Key Takeaways
The timeline revealed that the automated rate limit provided critical protection, blocking requests within three minutes while the manual platform pause took an hour to deploy after monitoring detected the activity. Without the automated circuit breaker, the additional $3 million would likely have been lost.
The failure occurred in internal accounting logic for subaccount transfers rather than in the smart contracts themselves, highlighting that security risks can exist in layers that handle bookkeeping and balance calculations. Integer underflows remain a well-understood but persistent class of bug in production systems.
