Arbitrum (ARB) Council Moved $30M of Binance Hack Funds Without Key

By Nodora News · 3 November 2026

Arbitrum (ARB) Security Council froze about $30M in ETH and ARB tied to the Binance hack by moving it without the hacker's key. Here's how it worked and why.

Arbitrum (ARB), the largest Ethereum layer-2 network, has drawn fresh attention to an unusual emergency move: its Security Council took about 8,426 ETH and 74.6 million ARB away from an address tied to the record $6.3 billion Binance hack, without ever needing the hacker's private key. The action was carried out at 8:08 a.m. Hong Kong time on Oct 30, and new technical breakdowns published on Nov 2 and Nov 3 show exactly how the council did it. At today's prices the frozen haul is worth roughly $30 million.

Key takeaways

• Arbitrum's 12-member Security Council froze 8,425.998 ETH and 74,559,805.2 ARB linked to the Binance exploit on Oct 30.
• It did so by briefly swapping the code of a core Arbitrum contract, sending transactions "as" the hacker's address, then restoring the original code in the same step.
• The funds now sit at a holding address ending in 0DA0 and can only be moved by an ArbitrumDAO governance vote.
• It is the second time this year the council has used this power, after freezing about 30,765 ETH from the KelpDAO exploiter in April.
• The move recovers only a small slice of the stolen $6.3 billion, but it raises big questions about who really controls funds on layer-2 networks.

What happened: Arbitrum freezes Binance hack funds

Hours after Binance's hot wallets were drained, part of the stolen money landed on Arbitrum One, the main Arbitrum network. Instead of waiting for the attacker to move it on, the Security Council stepped in. According to its own notice on the Arbitrum governance forum, it executed an emergency action that moved the funds from the exploit-linked address into a holding address.

The council said that "no other user's funds or applications were affected." It also said the frozen assets can only be moved by an ArbitrumDAO governance vote, "coordinated with relevant parties." In plain terms, the council cannot decide on its own what happens next, whether that is returning the money to Binance or something else.

For more background on the attack itself, see our earlier coverage of the record $6.3 billion Binance hack and North Korea's denial of the FBI's attribution.

How the Security Council moved funds without the hacker's key

On a normal blockchain, coins only move when the owner's private key, a secret number only they hold, signs a transaction. Arbitrum's freeze worked around that rule through its upgrade system.

The Security Council controls a shared wallet that needs at least 9 of its 12 members to sign. Using it, the council sent a single Ethereum transaction that did three things at once:

• Pointed Arbitrum's Inbox contract (the contract that carries messages from Ethereum into Arbitrum) at temporary replacement code.
• Used a new function in that code, called sendUnsignedTransactionOverride, to send two transactions that Arbitrum treated as if they came from the hacker's address.
• Switched the Inbox back to its original code.

Security firm Zealynx traced the transactions in a walkthrough posted on the Ethereum Magicians forum on Nov 2. It found the two messages arrived on Arbitrum One about 10 minutes later as a special transaction type with blank signature fields. One sent the ARB to the holding address, and the other sent the ETH. To the ARB token contract and to most block explorers, the move looks like an ordinary transfer that the holder made. Crypto outlet Unchained said its own read of the chain data matched that account.

The numbers behind the freeze

• ETH frozen: 8,425.998 ETH, worth about $19.0 million at today's price.
• ARB frozen: 74,559,805.2 ARB, worth about $11.4 million at today's price.
• Total: roughly $30 million, or about 0.5% of the estimated $6.3 billion stolen from Binance.
• Approval needed: 9 of 12 Security Council signers.
• Earlier precedent: about 30,765 ETH, then worth around $71 million, frozen from the KelpDAO exploiter on April 21.

The April case shows the money does not move quickly after a freeze. CoinDesk reported that getting the KelpDAO ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a federal judge in Manhattan had to modify a restraining notice before the DAO could vote to send it on.

Why it matters for Arbitrum and DeFi

For hack victims, the freeze is good news: some of the stolen funds can no longer be laundered. The FBI has blamed the Binance attack on North Korea's TraderTraitor group, and investigators have tracked the hackers spreading funds across many wallets and chains, so every frozen dollar counts.

The trade-off is decentralization. The episode confirms that whoever controls Arbitrum's upgrade path can make any address on the network spend its funds, with or without its key. Zealynx noted the council used powers the DAO had given it and disclosed both actions within about an hour and a half. Still, CoinDesk described it as a big caveat for a network that markets itself as decentralized.

There are knock-on effects too. Because the forced transactions used the address's next transaction numbers (nonces), anything the holder had pre-signed for those slots can no longer go through. And tools that judge an address by its own transfer history would count this move as the holder's own action, even though the holder never signed it.

Market reaction: ARB and ETH prices

The freeze has not lifted prices in a market that is still digesting the Binance hack and a wider risk-off mood. According to OKX data at about 4:50 p.m. Melbourne time (05:50 UTC) on Nov 3:

• ARB: about $0.1528, down roughly 6.4% in 24 hours (24h range $0.1514 to $0.1633).
• ETH: about $2,251, down roughly 1.9%.
• BTC: about $76,724, down roughly 2.2%.

You can follow these and other coins on Nodora's live charts.

What to watch next

• An ArbitrumDAO vote: the frozen ETH and ARB can only leave the holding address through governance. Watch the Arbitrum forum for a proposal on returning the funds to Binance or its users.
• Legal claims: after the KelpDAO case, outside claimants could again try to seize North Korea-linked funds before any vote goes through.
• Other networks: whether other chains or stablecoin issuers freeze more of the Binance loot as investigators trace it.
• Governance debate: expect renewed discussion about limiting or adding safeguards to the Security Council's emergency powers.

This article is for information only and is not financial advice.

#Arbitrum #ARB #Binance Hack #Ethereum #DeFi Security

This article is general information, not financial advice.