Arbitrum's Council Moved $30 Million of Binance Hack Funds Without the Hacker's Key

Published November 3, 2026, 10:45 AM PKT. Based on the Arbitrum Security Council's notice on the Arbitrum governance forum (primary source, as reported by CoinDesk and Unchained), security firm Zealynx's November 2, 2026 technical walkthrough on the Ethereum Magicians forum (primary technical source), CoinDesk's November 3, 2026 report, and Unchained's November 2, 2026 report (secondary sources). MABOnChain has not previously covered this recovery; the council's April 2026 KelpDAO recovery was noted only as background in earlier runs.

Arbitrum's Security Council moved about $30 million in cryptocurrency out of a wallet linked to Binance's $6.3 billion hack without the attacker's signature, using emergency powers that let it temporarily rewrite one of the network's core contracts. The council moved 74,559,805.2 ARB and about 8,426 ETH on October 30, 2026, hours after Binance's hot wallets were drained on October 29, according to the council's notice on the Arbitrum governance forum. At current prices that is roughly $30 million, a small fraction of the roughly $6.3 billion taken from Binance, but the method matters more than the amount: the council sent transactions that Arbitrum treated as coming from the hacker's own address, even though no private key signed them.

The $30 million move, made without a signature

On any blockchain, a wallet's funds normally move only when its private key, a secret number known only to the owner, signs off on the transfer. The council bypassed that rule entirely. The Security Council is a 12-member group elected by holders of the ARB token, with emergency powers to upgrade the network's contracts when nine of its 12 members agree. Its shared wallet, a Safe that requires nine signatures, sent a single Ethereum transaction that temporarily swapped the code of Arbitrum's Inbox, the contract that carries messages from Ethereum into Arbitrum. The replacement code added a function called sendUnsignedTransactionOverride, which let the council send transactions that Arbitrum treated as coming from the exploiter's address. Two such transactions moved the ARB and the ether to a holding address ending in 0DA0, and the original Inbox code was restored inside the same transaction, according to the council's notice. The council said no other user's funds or applications were affected, and that the funds can only be moved by an ArbitrumDAO governance vote, which will be coordinated with relevant parties.

How the override worked: the Inbox swap

Zealynx's walkthrough, posted November 2 on the Ethereum Magicians forum, traces the mechanics in detail. At 00:08 UTC on October 30, the council's Safe called Arbitrum's UpgradeExecutor in a single Ethereum transaction, in block 26301886. For a moment, the executor ran the Inbox on override code that logs the target address, unaliased, as the message's sender, then restored the original code once the message was in. It repeated the step for each asset, ARB first and ETH second. Both messages executed on Arbitrum One 9 minutes and 45 seconds after the Ethereum transaction, as type 0x65 transactions with zeroed signature fields, and they used the address's own transaction counters, nonces 2 and 3. The first sent the ARB to the holding address, and the second sent 8,425.99768 ETH there. Unchained's own read of Ethereum and Arbitrum One chain data matches that account. One detail makes the move nearly invisible in ordinary records: the ARB contract and indexers see a plain transfer that the holder appears to have made, Zealynx wrote. On Arbitrum One, what sets the transactions apart is their type, 0x65, and their blank signature. The forced transactions also consumed the address's next available nonces, blocking any pre-signed transactions the address had queued.

The April precedent and the legal delay

The council has done this before. In April 2026 it moved 30,765 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker. Getting that ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave. The same path now faces the $30 million: a governance vote, coordinated with relevant parties, with no timetable given. The FBI has attributed the Binance theft, which it said occurred on or about October 29, to North Korea's TraderTraitor activity, and the agency has urged node operators and virtual-asset providers to block transactions involving listed addresses. That attribution, plus the April legal fight, makes a quick release unlikely, even though the council moved fast to secure the funds.

The decentralization question the move raises

Zealynx wrote that it does not see a bug in any of this. The council used powers the DAO gave it and published both actions within an hour and a half, the firm wrote, adding that the assumption an address only moves when its key signs holds up to whoever controls the upgrade path. That is the sentence that has travelled furthest since the walkthrough appeared, because it states the tradeoff plainly. Arbitrum is a network that runs on top of Ethereum to make transactions cheaper, and it holds billions of dollars in user deposits while marketing itself as decentralized. The recovery shows that whoever controls the upgrade path can make any address on Arbitrum spend, which is a far stronger power than freezing funds. The council's defenders can point to the result: $30 million in stolen funds secured within hours, with no other user affected, through powers token holders themselves granted. Critics can point to the same facts and reach the opposite conclusion: a 9-of-12 committee moved a wallet's entire balance without its key, and the only thing standing between any user and the same treatment is the committee's judgment. For now the funds sit at the holding address, and the next decision belongs to ArbitrumDAO voters. This article is news reporting and is not investment advice.

Sources

• Arbitrum Security Council notice on the Arbitrum governance forum (October 30, 2026, primary source, as reported by CoinDesk and Unchained: 8,425 ETH and 74 million ARB moved, no other user's funds or applications affected, funds movable only by ArbitrumDAO governance vote)
• Zealynx, technical walkthrough on the Ethereum Magicians forum (November 2, 2026, primary technical source: 9-of-12 Safe, UpgradeExecutor, block 26301886, sendUnsignedTransactionOverride, type 0x65 transactions with zeroed signatures, nonces 2 and 3, 9 minutes 45 seconds execution, 8,425.99768 ETH, 74,559,805.2 ARB, both actions published within an hour and a half)
• CoinDesk, Arbitrum's council moved $30 million of Binance hack funds without the hacker's key (November 3, 2026, secondary source: roughly $30 million at current prices, 12-member council with 9-of-12 emergency powers, holding address ending in 0DA0, April KelpDAO precedent of 30,766 ETH worth about $71 million, weeks-long release and Manhattan court order)
• Unchained, Arbitrum's Security Council Can Move a Wallet's Funds Without Its Key, Binance Freeze Shows (November 2, 2026, secondary source: freeze at 8:08 a.m. Hong Kong time October 30, independent chain-data read matching Zealynx, ARB contract and indexers see a plain transfer, April notice details)
• TokenPost, Arbitrum Council Moved Binance-Linked Funds Without the Wallet's Key (November 3, 2026, secondary source: 8:08 p.m. ET October 29 timing, 74,559,805.2 ARB and about 8,426 ETH, Inbox proxy redirect and restore)