Arbitrum Security Council uses emergency powers to move Binance hack-linked funds

Traders Union
All News
Crypto
Arbitrum moves Binance hack funds

Highlights

Arbitrum Security Council used emergency contract change on Friday to move over 8,425 ETH and 74 million ARB from a Binance hack-linked address.
Nine of twelve council members approved the upgrade, enabling temporary control over the exploiter's address to recover assets without affecting other users or applications.
Previous asset recovery efforts became entangled in legal disputes over North Korea terrorism judgments, while the FBI attributes the latest Binance hack to North Korea's TraderTraitor group.

Emergency contract change enables asset recovery

As reported by CoinDesk, Arbitrum’s 12-member Security Council used its emergency upgrade authority last Friday to move more than 8,425 ETH and 74 million ARB from an address linked to the Binance exploit, despite not controlling that wallet’s key. The action required approval from nine council members and relied on a temporary change to one of the network’s core contracts.

The council’s shared Safe wallet sent an Ethereum transaction that briefly replaced the code of Arbitrum’s Inbox contract, which carries messages from Ethereum into Arbitrum. The substitute code added a function called _sendUnsignedTransactionOverride_, allowing the council to send transactions that Arbitrum recognized as if they came from the exploiter’s address.

Two transactions then moved the ether and ARB to a holding address ending in 0DA0, after which the original Inbox code was restored in the same transaction. In a notice on the Arbitrum governance forum, the council said no other user funds or applications were affected and that the recovered assets can be moved only through an ArbitrumDAO governance vote coordinated with relevant parties.

Decentralization concerns and legal overhang

Security firm Zealynx said the funds reached Arbitrum about 10 minutes after the Ethereum transaction as type 0x65 transactions with blank signature fields, using the exploiter address’s own transaction counter. The firm said the council acted within powers granted by the DAO and disclosed both actions within about an hour and a half, but added that wallet control assumptions hold only up to whoever controls the upgrade path.

That caveat is significant for a network that presents itself as decentralized, because it means whoever controls the upgrade path can make any address on Arbitrum spend. The council has used the same approach before, moving 30,766 ETH in April, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker.

That earlier recovery became tied up for weeks after families holding unpaid terrorism judgments against North Korea tried to claim the assets. A Manhattan federal judge eventually modified a restraining notice before the DAO could vote to send the funds to Aave. The latest Binance hack attribution also adds geopolitical weight, with the FBI saying on Oct. 31 that North Korea’s TraderTraitor group is behind the breach.

In our earlier article, we covered the opening of the long-delayed New Yalu River Bridge linking Dandong in China with North Korea, a move aimed at reviving cross-border commerce after years of disruption. We noted that the new crossing could ease the flow of heavy equipment and raw materials, while analysts cautioned that trade is still unlikely to quickly return to pre-sanctions levels.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.