Arcus Exchange Exploit Results in $2.2 Million Loss
An accounting bug on the Arcus decentralized exchange led to a loss of $2,234,391 USDG. The exchange paused withdrawals, fixed the issue, and covered the loss from its treasury.
On November 9, 2026, an attacker exploited an accounting bug in the decentralized exchange Arcus, specifically in the sub-account fund transfer mechanism. This exploitation allowed the attacker to inflate their account balance and withdraw 2,234,391 USDG on-chain. An additional approximately $3 million in withdrawal requests were blocked by the bridge’s rate limit and were later reversed.
In response to the incident, Arcus paused all withdrawals and worked to fix the bug within about an hour. Following the resolution of the issue, the exchange restored its services and fully covered the shortfall from its company treasury. Importantly, no other user balances, positions, or orders were affected by this exploit.