---
title: Arcus DEX loses $2.23M USDG to a subaccount-transfer accounting bug; on-chain rate limit held back another $3M | ctxsec
url: https://ctxsec.com/items/arcus-dex-subaccount-transfer-accounting-bug-2-23m-usdg-withdrawn-nov-9
description: "Arcus, the perpetuals and tokenized-stock exchange, says a newly created account exploited a bug in transfers between a user's own subaccounts at about 10:07 PM ET on Nov 9, letting it record a far larger balance than it held. $2,234,391 USDG left on-chain before withdrawals were paused; a further $3M was held by the bridge's withdrawal rate limit and later reversed. Arcus deployed a fix at 11:37 PM ET, blocked the exploiter's addresses, and covered the shortfall from its treasury; no other accounts were affected."
status: "official (Arcus incident report, Nov 10, 2026)"
published: 2026-11-10
---

> Arcus, the perpetuals and tokenized-stock exchange, says a newly created account exploited a bug in transfers between a user's own subaccounts at about 10:07 PM ET on Nov 9, letting it record a far larger balance than it held. $2,234,391 USDG left on-chain before withdrawals were paused; a further $3M was held by the bridge's withdrawal rate limit and later reversed. Arcus deployed a fix at 11:37 PM ET, blocked the exploiter's addresses, and covered the shortfall from its treasury; no other accounts were affected.

[← Cybersecurity News](/news) · [markdown](/items/arcus-dex-subaccount-transfer-accounting-bug-2-23m-usdg-withdrawn-nov-9.md)

official (Arcus incident report, Nov 10, 2026)

2026-11-10 11:41 PM ET

### Arcus DEX loses $2.23M USDG to a subaccount-transfer accounting bug; on-chain rate limit held back another $3M

- **Timeline (ET):** 10:10 PM rate limit capped payouts; 10:15 PM monitoring alert; 11:07 PM withdrawals paused; 11:37 PM fix deployed; 4:26 AM withdrawals re-enabled; 12:28 PM Nov 10 shortfall covered.
- **Exploiter address** named by Arcus: 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd. Arcus is working with blockchain investigators and asks exchanges to flag funds from it.
- **Takeaway:** a hard on-chain withdrawal rate limit turned a potential $5M+ loss into $2.2M; internal balance transfers deserve the same invariant checks as deposits and withdrawals.

Sources: [Arcus: Incident Report, November 9, 2026 (published Nov 10, 2026)](https://arcus.xyz/blog/arcus-incident-report-november-9-2026) · [Arcus on X (Nov 10, 2026)](https://x.com/arcus_xyz/status/2120246299383763171)