How Arbitrum's council moved coins it held no key for

At 8:08am Hong Kong time on 30 October, Arbitrum’s Security Council froze 8,425 ETH and 74,559,805.2 ARB held by an address its notice ties to the Binance exploit.Arbitrum Security Council notice of emergency action, 30 October 2026. CoinDesk puts the value at about $30 million and says the council moved it without the attacker’s signature.CoinDesk: Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key. The FBI says North Korea was responsible for the theft of more than $6 billion from Binance, on or about 29 October.BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers. CoinDesk describes the move as the second of its kind this year.

No key was involved. The power to do this is written into Arbitrum’s rules, and it lets a small elected group act on any address on the chain. The transaction that used it shows how.

The switch is written down

Arbitrum’s constitution gives the council “the power to execute any software upgrade or perform other required actions with no delay” in a security emergency.The Amended Constitution of the ArbitrumDAO (governance docs). An emergency action needs nine of the 12 members to approve. The DAO’s governance docs say the 12 are elected by the members of the ArbitrumDAO.Security Council: a conceptual overview (Arbitrum DAO governance docs).

The constitution also limits the power. The council must not use it “except in a true security emergency, such as a critical vulnerability” in a chain the DAO governs. Afterwards it must issue a full transparency report explaining what was done and why it was justified. And the DAO can curtail or eliminate the power through a Constitutional AIP, the DAO’s binding vote.

The Ethereum transaction that carried out the October action had exactly nine signatures, the minimum.Ethereum transaction 0xb69c81774f50… executing the 30 October emergency action. The April transaction also had nine.

How you move coins without a key

On Arbitrum, a transaction normally moves funds because the owner’s key signed it. The council’s route went around that, through Arbitrum’s Inbox contract on Ethereum, which is how messages enter the chain. According to the council’s notice, the plan was one atomic action: upgrade the Inbox, freeze the funds, and put the original contract back.

The upgrade added a function called sendUnsignedTransactionOverride, which imitates a standard cross-chain transaction but lets the sender be set to someone else. The council then created two cross-chain transactions that impersonated the address linked to the exploit, and these moved the funds to a holding address, 0x0000000000000000000000000000000000000DA0. An outside analyst at DeFi Prime explains that on this path the sender comes from the incoming message metadata and is not recovered from the signature of an ordinary signed transaction.DeFi Prime: Arbitrum Council moves Binance exploit funds without a signature. On 5 November the holding address held 74,559,805.2 ARB, the amount in the council’s notice.

The same technique was used in April. The council’s notice for that action describes the same three stepsArbitrum Security Council notice of emergency action, April 2026 (KelpDAO). and the same function. That action froze 30,765.67 ETH linked to the KelpDAO exploit.ArbitrumDAO forum thread on releasing the KelpDAO-linked frozen ETH (April to June 2026). The notice dates it 21 April, but the Ethereum timestamp puts it at 23:26 US Eastern on 20 April.

The case for it, and the objection

The case for acting was made at length when the council first did it, in April. The Defiant summarised it this way: the funds were headed to a sanctioned state actor, the council acted narrowly, it did not touch ordinary users, and it cannot redirect the funds without a DAO vote.The Defiant: Arbitrum froze $70M of stolen funds. Was it wrong?. Steven Goldfeder, a co-founder of Offchain Labs, said in April, as Parameter reported, that “The default was do nothing”.Parameter: Arbitrum’s $71M emergency freeze after KelpDAO hack reignites centralization concerns. He rejected a full token-holder vote: “The DAO cannot be consulted, because the second the DAO is consulted, that essentially means North Korea is consulted”. Patrick McCorry, head of research at the Arbitrum Foundation, said of the council’s powers: “You can see exactly what powers they have”. Goldfeder added that Arbitrum is “no more or less decentralized today than we were yesterday”.

The objections are about scope and neutrality. Robby Greenfield of tokedex.org wrote on the Arbitrum forum in April that the capability “is not scoped to recovery” and is a general-purpose power embedded in the upgrade authority. Another commenter on the thread wrote that the action created a precedent and that “ETH was moved on Arbitrum without the user’s consent”. The Defiant summarised the critics’ view as the worry that a council able to freeze a state-linked hacker today could be compelled to freeze anyone tomorrow, and the chain would be “no longer neutral”.

The constitution’s own example of an emergency is a vulnerability in a DAO-governed chain. Two other emergency actions this year were of that kind. The council’s May notice says no funds were ever at risk,Arbitrum Security Council notice of emergency action, May 2026. and on 2 October it paused activation of new Stylus contracts.Arbitrum Security Council notice of emergency action, 2 October 2026.

Where the funds go

The council’s notice says the frozen funds can only be moved by an ArbitrumDAO governance vote. On 5 November Binance posted a proposal asking for that vote: it wants the 8,425.997 ETH and 74,559,805.2 ARB released to it.Binance proposal to the ArbitrumDAO to release the frozen ETH and ARB, 5 November 2026. Binance, whose proposal says the funds were stolen from its wallet, would get them back. It describes the on-chain step as similar to the council’s own action.

Binance estimates the whole process at around 49 days, including a week of forum discussion, a week of temperature check and two weeks of on-chain voting. It also agrees to indemnify the Arbitrum Foundation, Offchain Labs, the Security Council and each member of it. The proposal notes that third parties have previously claimed assets frozen on Arbitrum One, on the theory that they belong to people alleged to be responsible for an exploit.

April shows how that can go. The Aave-led proposal to release the KelpDAO funds was posted on 25 April. A lawyer who said he represents plaintiff-judgment creditors in a case against North Korea then posted a restraining notice on the thread. The Arbitrum account announced on 15 June that the payload had executed and the ETH had gone to Aave LLC. That was 56 days after the freeze.