The hack spree continues. Over the past two weeks we covered the Binance hack post mortem, the Mercado Bitcoin hack and the StonkFun website attack. Now a perp DEX we list has taken a hit too.
Short answer: The Arcus exploit hit Arcus Perps, a trading platform on Robinhood Chain, on the night of November 9. A newly created account abused a flaw in transfers between its own subaccounts. That bug inflated its recorded balance, and the attacker withdrew 2,234,391 USDG against it. Arcus patched the bug within an hour and covered the full shortfall from its company treasury. User balances, positions and orders stayed untouched.
Here is how it worked, what stopped it from getting worse, and what it means for anyone farming Arcus.
What Happened in the Arcus Exploit
Arcus is a trading platform on Robinhood Chain. The team behind dYdX built it in partnership with Robinhood Crypto, which also invested. Spot markets offer tokenized stocks, while perps cover stocks, crypto, commodities and indices.
On November 9 at around 10:07 PM Eastern Time, a brand new account started moving funds between its own subaccounts. Somewhere in that flow, the exchange’s books stopped matching reality. The account suddenly showed a balance far larger than anything it had deposited.
Next, the attacker requested withdrawals against that fake balance. About $2.23 million in USDG left the platform on chain before Arcus halted withdrawals.
According to Arcus, only this single account took part. As a result, no other user lost funds, and no positions or orders changed.
How the Subaccount Bug Worked
Most perp platforms let you split one wallet into several subaccounts. Traders use them to separate strategies or isolate risk. On Arcus, transfers between those subaccounts never touch the blockchain. Instead, the exchange simply updates its internal ledger while the funds stay in custody.
That design is normal and fast. However, it means the ledger must be perfect. In this case, a flaw in how Arcus processed those internal transfers let one account record more money than it held.
The real damage came at the next step. An internal number is harmless while it stays internal. Here, though, the inflated balance passed the withdrawal checks, so fake money turned into real USDG on chain.
Arcus has not shared the exact conditions that triggered the bug. Its incident report only confirms the subaccount transfer flaw. Notably, the platform had expanded multi-asset collateral to all traders a few days earlier, between November 5 and 7. Nothing links the two yet, but it is worth watching in a full post mortem.
The Arcus Exploit Timeline
Arcus published a clear sequence of events, all in Eastern Time:
- 10:07 PM, November 9: the new account starts exploiting the subaccount bug.
- 10:15 PM: Arcus monitoring flags the suspicious withdrawals, and the team starts investigating.
- Within the hour: the team finds the flaw and patches it.
- 4:26 AM, November 10: withdrawals reopen for every user.
- 5:02 AM: Arcus reverses the attacker’s remaining pending withdrawals.
- 12:28 PM: the company treasury covers the full shortfall.
In short, eight minutes from first move to first alert is fast. By comparison, many exploits run for hours before anyone notices.
The Rate Limit That Saved $3 Million
The attacker wanted more. On top of the $2.23 million that got out, they requested another $3 million in withdrawals.
Fortunately, that money never left. Robinhood Chain’s bridge applies an on-chain rate limit to withdrawals, and it held the requests back. Arcus later reversed them, so none of that $3 million reached the attacker.
This is the part I like most about the incident. A boring safety rule did its job before any human could react. Without that cap, the loss would have been more than double.
In addition, Arcus has published the attacker’s first address. It asked exchanges and service providers to flag any funds linked to it. Blockchain investigators are helping trace the stolen USDG, and Arcus says it will work with law enforcement where needed. Meanwhile, an on-chain message reportedly offers the attacker a 10% bounty to return the rest.
Of course, recovery is never a sure thing, as our guide on whether stolen crypto can be recovered explains. Still, flagged funds are much harder to cash out.
Arcus Paid the Bill, and That Is Rare
Most DeFi victims never see their money again. In our ranking of the biggest crypto hacks of all time, only a handful of DeFi and bridge entries ended with users covered. Several of those depended on the hacker’s goodwill.
The Drift exploit shows the other side. That Solana perp DEX lost $285 million in April, and none of it came back.
Arcus took a different path. The team patched fast, reopened withdrawals the same morning, and then filled the hole from its own treasury. Consequently, traders kept every dollar, even though the bug was in Arcus’s own code.
To be clear, a self-funded refund does not make the bug acceptable. A platform holding user money needs its ledger right every time. Nevertheless, how a team responds tells you a lot about who you are trusting. Our running DeFi hacks 2026 guide tracks every protocol exploit this year, and few of them end this cleanly.
Is Robinhood Chain Safe After the Arcus Exploit?
Yes, as far as anyone can tell. The bug sat in Arcus’s internal accounting, not in the chain. Robinhood Chain itself kept running normally, and its bridge rate limit actually helped contain the damage.
Even so, the incident matters for the ecosystem. Arcus is one of the most prominent apps on the chain. Moreover, Vlad Tenev just told investors that DeFi perps on the network topped $1 billion in daily volume. We covered that call in our Robinhood Q3 earnings breakdown.
In other words, the chain is growing fast, and so are the targets on it. If you are new to the network, our Robinhood Chain explainer covers how it works. Meanwhile, our Robinhood airdrops hub lists every campaign on the chain that our team has verified.
What the Arcus Exploit Means for Farmers
Arcus is on our farming radar for a reason. A points program has surfaced with a Season 0, weekly distributions and tiers. However, Arcus has not confirmed that points convert to a token, and no allocation exists yet. We track every update on our Arcus airdrop page. We also named Arcus as one of our best bets in the biggest DEX airdrops ranking.
For now, this exploit does not change that view. Instead, it reminds us of the risk that comes with every young platform. Audits and big-name backers lower the risk, but they never remove it.
So size your exposure on purpose. Don’t park more on a new venue than you can afford to see frozen for a night. Also, when a platform I use gets hit and withdrawals are still open, I move funds to self custody first. Then I wait for the storm to pass and decide later whether to come back.
Above all, spreading volume across venues helps. Our best perp DEX ranking compares the main platforms on liquidity and fees. Our which DEX is safe guide compares how each one holds your funds. For the low-risk way to build volume, read our delta neutral airdrop farming guide.
Keep This Content Free
Hack nights keep our team at the desk until the numbers stop moving. If these breakdowns help you stay safe, open your exchange account through our links. It costs you nothing extra:
Want your trading volume to earn more than PnL? Check the CEX bonuses and DEX points campaigns on our trading airdrops page.
Final Words
The Arcus exploit could have been much worse. A subaccount bug let one account withdraw $2.23 million it never owned. Then a bridge rate limit blocked another $3 million, and Arcus covered the gap from its own treasury.
Luckily, users lost nothing this time. Still, the lesson for farmers stays the same: new platforms carry real risk, so size your positions accordingly.
The same night, another attacker hijacked the website of the Across bridge. That breakdown is next.
FAQ
What happened in the Arcus exploit?
A newly created account abused a flaw in transfers between its own subaccounts on Arcus Perps. The bug inflated its balance, and the attacker withdrew 2,234,391 USDG on November 9 and 10, 2026.
Did Arcus users lose money?
No. Arcus covered the full shortfall from its company treasury. User balances, positions and orders stayed unchanged.
How much was stolen from Arcus?
About $2.23 million in USDG left the platform. Another $3 million in withdrawal requests never got out, because the bridge’s rate limit held them back.
Was Robinhood Chain hacked?
No. The bug was in Arcus’s internal accounting system. Robinhood Chain itself kept working normally.
Is the Arcus airdrop still worth farming?
Arcus runs a Season 0 points program, but it has not confirmed a token or an allocation. The exploit does not change that. It does show why you should limit your exposure on any young platform.
