Quick answer: The Arbitrum Security Council moved 8,426 ETH and 74.56 million ARB, about $30.4 million, out of a Binance exploit address on Oct. 30, 2026 without the hacker’s private key. It briefly swapped the code of Arbitrum’s Inbox contract, then restored it. Only an ArbitrumDAO vote can now release the funds.
The Arbitrum Security Council pulled roughly $30 million in stolen crypto off an address tied to the $6.3 billion Binance hack, and it never needed the hacker’s private key. Instead, the 12-member council briefly rewrote one of Arbitrum’s core contracts so the network accepted transfers in the attacker’s name.
The freeze happened on Oct. 30, 2026. However, it became a talking point this week after security firm Zealynx published a step-by-step walkthrough on Nov. 2, and CoinDesk and Unchained picked it up.
What did the Arbitrum Security Council do?
At 00:08 UTC on Oct. 30 (8:08 a.m. Hong Kong time), the council executed an emergency action. It froze 8,425 ETH and 74,559,805.2 ARB held on Arbitrum One by an address “identified with today’s Binance exploit,” according to its notice on the Arbitrum forum.
The method is the real story. In a single Ethereum transaction, the council upgraded the Inbox contract, which carries messages from Ethereum into Arbitrum. The temporary code added a function called sendUnsignedTransactionOverride. It let the council send two transactions that Arbitrum treated as coming from the exploiter’s own address.
Those transfers moved the ARB first and the ether second to a holding address ending in 0DA0. Then the original Inbox code went back in place, all inside the same transaction. “No other user’s funds or applications were affected,” the notice said.
How could the council move funds without a key?
On most blockchains, a wallet moves only when its private key signs. Arbitrum is a layer-2 network on top of Ethereum, so its rules can be upgraded from Ethereum. Whoever controls that upgrade path can, in effect, write new rules for a moment.
The council’s Safe wallet needs nine of its 12 signers to act, CoinDesk and Unchained reported. Zealynx found the two transfers landed on Arbitrum about 10 minutes after the Ethereum transaction. They arrived as type 0x65 transactions with blank signature fields and used the exploiter’s own transaction counter.
Zealynx said it does not “see a bug in any of this.” The council “used powers the DAO gave it and published both actions within an hour and a half,” the firm wrote. Still, its warning to builders was blunt: the idea that only a key can move a wallet holds “up to whoever controls the upgrade path.”
Why it matters for Arbitrum users
This is the second time in 2026 the council has used this power. In April, it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter, CoinDesk reported. Releasing that ether took weeks. Families holding terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave.
Two readings are possible, and both are fair. On one side, a fast freeze kept about $30 million away from a hacker the FBI has linked to North Korea’s TraderTraitor group. On the other, it proves that a small elected group can move any address on the chain if nine members agree.
Offchain Labs CEO Steven Goldfeder told Unchained in July that the April action was by design. The power sat with “this external entity” that is “broadly elected,” he said. As a result, the debate is less about Arbitrum breaking its rules and more about what “decentralized” means on a rollup with upgrade keys. The same question sits behind the SEC’s new decentralization FAQ.
Data and context: how big is the freeze?
We checked the holding address through Arbitrum’s public RPC at 08:52 UTC on Nov. 3, 2026. It held 8,426.05 ETH and 74,559,805.2 ARB. At CoinGecko prices at that time, ETH at $2,251.41 and ARB at $0.1533, that is about $18.97 million in ether and $11.43 million in ARB, or roughly $30.4 million in total.
That is under 0.5% of the Binance loss. For comparison, Elliptic has said about $2.85 billion of the stolen funds has been frozen or seized across chains, while Binance kept replenishing affected assets. Meanwhile, ARB is weak. It traded at $0.1533, down 4.5% in 24 hours and about 25% below its $0.204 level on Oct. 5, per CoinGecko daily data.
Similar intervention debates have hit other protocols during this hack, including THORChain’s pause and Aave’s frozen loan decision.
What to watch next
- The ArbitrumDAO vote. The funds can move only through governance “coordinated with relevant parties.” Watch for a proposal naming Binance or law enforcement as the recipient.
- Legal claims. After April, creditors with judgments against North Korea may again try to attach the frozen assets.
- Governance pushback. Expect proposals to narrow emergency powers, add delays, or require more signers.
- Other layer-2 networks. Many rollups keep similar upgrade councils. Users should read each network’s security model before bridging large sums.
Arbitrum Security Council FAQ
What is the Arbitrum Security Council?
The Arbitrum Security Council is a 12-member group elected by ARB token holders. It can upgrade Arbitrum’s contracts in an emergency when at least nine members sign. On Oct. 30, 2026 it used that power to freeze about $30 million in Binance exploit funds.
Can the Arbitrum Security Council move my funds?
Technically, yes. The Binance freeze showed that whoever controls Arbitrum’s upgrade path can make any address spend, even without its key. The council says it used the power only on an exploit-linked address, and no other user’s funds were touched.
What happens to the frozen Binance funds?
They sit at the holding address 0x…0DA0 on Arbitrum One. According to the council’s notice, they can move only after an ArbitrumDAO governance vote. In April, a similar release took weeks because of legal claims.
Not financial advice. Crypto assets are volatile; DYOR before bridging or holding funds on any network.
Sources
- Arbitrum forum: Security Council Emergency Action, Oct. 30, 2026
- CoinDesk: Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key
- Unchained: Arbitrum’s Security Council can move a wallet’s funds without its key
- TechFlow: Arbitrum Security Council transfers about $30.45 million
- Arbiscan: holding address 0x…0DA0
- CoinGecko: Arbitrum (ARB) price
