Arcus DEX loses $2.23M USDG to a subaccount-transfer accounting bug; on-chain rate limit held back another $3M
- Timeline (ET): 10:10 PM rate limit capped payouts; 10:15 PM monitoring alert; 11:07 PM withdrawals paused; 11:37 PM fix deployed; 4:26 AM withdrawals re-enabled; 12:28 PM Nov 10 shortfall covered.
- Exploiter address named by Arcus: 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd. Arcus is working with blockchain investigators and asks exchanges to flag funds from it.
- Takeaway: a hard on-chain withdrawal rate limit turned a potential $5M+ loss into $2.2M; internal balance transfers deserve the same invariant checks as deposits and withdrawals.
Sources: Arcus: Incident Report, November 9, 2026 (published Nov 10, 2026) · Arcus on X (Nov 10, 2026)