Arbitrum Security Council transfers approximately $30.45 million in stolen Binance funds without a private key

By TechFlow

At 08:08 Beijing Time on October 30, 2026, the Arbitrum Security Council transferred 8,425 ETH and 74,559,805.2 ARB from an address linked to the Binance theft case on Arbitrum One into an address that can only be accessed via an ArbitrumDAO vote, without possessing the attacker's private key. According to TechFlow's calculations, this batch of assets was worth approximately $30.45 million at 15:54 Beijing Time on November 3, accounting for about 0.48% of Binance's affected amount of roughly $6.3 billion.

How the Security Council Moved Funds Without Private Keys

According to the Arbitrum Security Council Forum Announcement, the committee performed an atomic upgrade to the Inbox contract on Ethereum: it added the function sendUnsignedTransactionOverride to construct two cross-chain transactions impersonating the stolen address, routed the funds to 0x0000000000000000000000000000000000000DA0, and then reverted the Inbox to its original implementation. All steps were completed within a single Ethereum transaction at block 26,301,886, timestamped October 30, 00:08:35 UTC. The announcement stated: "No other users' funds or applications were affected."

According to CoinDesk, the Security Council consists of 12 members elected by ARB holders, with emergency actions requiring signatures from at least nine of them. In an on-chain analysis posted on the Ethereum Magicians forum, security firm Zealynx noted that approximately 10 minutes after the Ethereum transaction execution, two type 0x65 transactions were submitted to Arbitrum One. Their signature fields (r, s, v) were all zero, occupying the second and third nonces of the compromised address.

On Arbitrum, whether funds can be moved from an address ultimately depends on obtaining 9 signatures from the 12-person committee that controls the upgrade path; the private key is merely one layer of protection. As Zealynx put it, the notion that "an address only moves when signed by its private key" only holds true below those who control the upgrade path.

Freezing All of Binance's Stolen Assets on Arbitrum

In a prior on-chain review by TechFlow, attackers transferred all 8,426 ETH and 74.6 million ARB stolen from Binance on Arbitrum between 05:35 and 05:38 Beijing Time on October 30 into a new wallet starting with 0x3e2b, which Zealynx identified as the impersonating sender. Based on TechFlow's calculations, the Security Council intervened approximately 2.5 hours after the funds entered that wallet, freezing all of Binance's stolen assets on the chain.

TechFlow queried an Arbitrum public node and found that as of 15:54 Beijing Time on November 3, the 0DA0 address held 8,426.05 ETH and 74,559,805.2 ARB. Valued at CoinGecko's prices at the same timestamp (ETH at $2,255.38 and ARB at $0.1535), the total is approximately $30.45 million.

The April Precedent: Legal Obstacles Hindered Fund Release

Freeze EventExecution TimeFrozen AssetsCurrent Status

KelpDAO AttackApril 21, 23:26 Eastern Time30,765.67 ETHTransferred to Aave following DAO vote

Binance TheftBeijing Time October 30, 08:088,425 ETH, 74,559,805.2 ARBPending DAO vote

According to the April forum announcement, the frozen ETH was also transferred to the 0DA0 address. On April 25, five entities including Aave Labs submitted a proposal requesting the funds be used to compensate rsETH holders. According to CoinDesk, the ETH was then worth approximately $71 million. Families holding a US court judgment for terrorism damages against North Korea attempted to claim the funds. After a Manhattan federal judge modified an injunction, the DAO finally voted to transfer the assets to Aave. TechFlow calculates that the combined frozen amount across both incidents totals approximately 39,192 ETH.

The FBI attributed the Binance theft to the North Korean hacking group TraderTraitor on October 31. The Arbitrum governance forum will hold a proposal discussion meeting at 00:00 Beijing Time on November 4, with this emergency action listed only under "Quick Updates"; as of 16:00 Beijing Time on November 3, no proposal to release these funds had yet appeared on the forum.