Arcus subaccount accounting bug enabled a 2,234,391 USDG withdrawal
Arcus says a newly created account inflated its recorded balance through transfers between its own subaccounts. It withdrew 2,234,391 USDG. The bridge held another roughly $3 million in requests, which were reversed. Arcus covered the shortfall from its treasury.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Arcus exchange accounting for transfers between subaccounts. Arcus reports one exploiting account and no affected user balances.
- DeFi · Arcus · accounting
- In the wild
- Yes
- Arcus confirms the unauthorized withdrawal and says it deployed an accounting fix.
What happened
Arcus attributes the incident to an accounting error in transfers between a user’s own subaccounts. It has not published the exact triggering conditions or a user-side patch. The 2,234,391 USDG was paid out. The other roughly $3 million was only requested. Treasury coverage made up the shortfall while the withdrawn funds were still being tracked. Arcus says trading and withdrawals are operating normally and that other users’ balances, positions and orders were unaffected.
Crime-scene timeline
Nov 10, 2026
A new account exploits subaccount transfers
Arcus dates the start to approximately 10:07 PM ET on November 9 (03:07 UTC on November 10).
Nov 10, 04:07 UTC
Arcus pauses withdrawals
The bridge had already limited further payouts.
Nov 10, 04:37 UTC
Arcus deploys the fix
The team subsequently blocks the exploiting addresses.
Nov 10, 09:26 UTC
Arcus reopens withdrawals
At 10:02 UTC it reverses the blocked withdrawal requests.
Nov 10, 2026
Arcus discloses the incident and covers the shortfall
Arcus reports using its own treasury and tracking the withdrawn funds.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Arcus Labs incident reportPrimaryConfirms the accounting path, withdrawn funds, blocked requests, recovery and the initial address.