Arcus exploit: the $2.23M left Robinhood Chain before the block, and almost all of it is still with the attacker

Arcus is a self-custodial perpetuals exchange on Robinhood Chain. According to its incident report, at 10:07 PM ET on 9 November (03:07 UTC on 10 November) an attacker exploited a bug in transfers between sub-accounts that inflated an account balance, and withdrew 2,234,391 USDG, Paxos’s dollar stablecoin. The bridge’s rate limit held back about $3M more, which was never paid out and was later reversed. Arcus paused withdrawals at 11:07 PM ET, deployed a fix at 11:37 PM, blocked the exploiter’s addresses at 11:43 PM ET (04:43 UTC) and covered the full shortfall from its treasury the next day; it says no user balances were affected. It published one address: 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd.

The same address had prepared the day before: at 06:27 UTC on 9 November it swapped 0.02 ETH for 42 USDG on Robinhood Chain through Relay.link. After the withdrawal it used Relay.link again, this time to leave the chain. Between 03:13 and 03:57 UTC it sent nine requests, from 55,000 to 1,000,000 USDG, to be paid as ETH on Ethereum to the same address. Two requests (560,039 and 58,471 USDG) were refunded on Robinhood Chain and resubmitted; the seven that went through carried 2,234,418 USDG and paid 1,052.2 ETH on Ethereum, the last at 03:59 UTC. That was 44 minutes before Arcus blocked the address. USDG is a token its issuer can freeze; ETH is not.

From 05:41 to 06:20 UTC the attacker wrapped 475.90 ETH and sold it in eleven orders through CoW Protocol for 1,008,945 DAI. Between 13:18 and 15:29 UTC it sent all of that DAI, in fifteen transfers, to a fresh address 0x9a30f6a596F3354Ecb90D6BD3A2A16750DcF13D0, which has not moved any of it.

About 101 ETH went to Bitcoin. A first attempt through Chainflip (0.47 ETH) was refunded. Three THORChain swaps (0.47, 4.71 and 47.79 ETH) and two Relay.link transfers through the hop 0xA91fE480c2062aFB18Df55Ac6aDFa0104633a3e2 (0.48 and 47.79 ETH) all paid the same Bitcoin address bc1qtlme3nlwhlrcdjw5xv8g83t8fakw6snze79wn7: 2.831 BTC in five payments, none spent.

The remaining 475.06 ETH is on the exploiter’s own address. Adding it up, almost the whole loss is still held by the attacker: about $1.0M in ETH, $1.0M in DAI and $0.2M in BTC, against $2.23M taken. None of it has been sent to an exchange or a mixer as of 11 November.

Open these addresses in an explorer and they appear to send and receive hundreds of thousands of "DAI" and "ETH" to addresses that start and end like the attacker’s own (for example 0x9a3dF1e6…, 0x9A3021e2…, 0xA91FDAA3…). Those are fake tokens and look-alike addresses from address-poisoning bots, which hope the attacker will copy a wrong address. Counting only the real DAI and WETH contracts, the flows are the ones above.

It does not say who the attacker is, and it does not say that Relay.link, CoW Protocol, THORChain or Chainflip did anything wrong: they are services the money passed through. The description of the bug, the timeline in Eastern Time and the loss figure are Arcus’s. The path of the money and the balances are PublicAML’s own reading of Ethereum, Bitcoin and Relay.link’s public request records on 11 November 2026. All four attacker addresses are labelled in PublicAML.