Arcus disclosed that it was stolen approximately 2.23 million USD due to accounting loopholes, which has been fully compensated from the company's treasury

The decentralized trading platform Arcus disclosed that on November 10, Beijing time, an accounting vulnerability was discovered, allowing users to withdraw funds they were not entitled to. Arcus detected and fixed the vulnerability within an hour and has covered the entire gap. User balances were not affected, and trading and withdrawals continued normally.

The report indicated that at 11:07 on November 10, Beijing time, a newly created account exploited a vulnerability in the exchange's processing of transfers between user sub-accounts, recording a balance far exceeding the actual holdings and requesting withdrawals. Before withdrawals were halted, approximately $2.234 million USDG had been withdrawn on-chain, and another $3 million withdrawal requests were intercepted by the cross-chain bridge's rate limit, which were not paid and subsequently canceled. Arcus Labs has fully compensated the gap from the company treasury, is working with blockchain investigators to trace the funds, and has disclosed the attacker's initial address, requesting exchanges and service providers to flag the related funds.