Overview
- A newly created account exploited an accounting error in Arcus’s handling of transfers between user sub-accounts, allowing it to record inflated balances and withdraw about $2.23–$2.234 million on Monday.
- Arcus detected the flaw, patched the code within roughly an hour, and said no customer balances were affected because the platform covered the shortfall from its corporate treasury.
- Additional withdrawal requests worth about $3 million were blocked by cross-chain bridge rate limits and were never paid out.
- The company has published the attacker’s first on-chain address, has asked service providers to flag linked assets, and is working with blockchain investigators but has not reported any fund recoveries or released a full technical post‑mortem.
- Arcus is a beta tokenized-stock and perpetuals exchange built by the dYdX team with Robinhood Crypto that offers cross-margining and up to 50x leverage, and the recent multi-asset collateral rollout increases accounting complexity and raises questions about future audits and disclosure.