Another approximately 3 million USD withdrawals were intercepted due to triggering cross-chain bridge limits, followed by the request being rolled back by the system.

Written by: Ma He, Foresight News

On the evening of November 9, a bookkeeping vulnerability incident occurred on the perpetual contract trading platform Arcus of Robinhood Chain. A newly registered account exploited a loophole in the platform's processing of transfers between user sub-accounts, artificially inflated the balance, and successfully withdrew approximately 2.2344 million USDG, while another approximately 3 million USD withdrawal was intercepted due to triggering cross-chain bridge limits, leading to the request being rolled back by the system.

The official report stated that the incident involved only a single account, and other users' balances, positions, and orders were unaffected. The platform has fully covered the gap using its own funds, and trading and withdrawals have now returned to normal.

A retrospective on this hours-long tug-of-war reveals a timeline that is nothing short of "speed of life and death."

On November 9 at 10:07 PM Eastern Time, the newly registered account launched an attack exploiting the bookkeeping flaw in sub-accounts.

In the following 3 minutes, due to risk control's failure to identify the inflated balance in a timely manner, the system was successfully breached and 2.2344 million USDG was withdrawn by the attacker. It wasn't until 10:10 PM that the underlying automated limit mechanism of the cross-chain bridge was triggered, forcibly intercepting subsequent withdrawal requests amounting to approximately 3 million USD.

By 10:15 PM, the platform's monitoring system officially issued an alert, and the team immediately intervened to investigate.

Subsequently, the Arcus team's defensive actions began to accelerate.

At 11:07 PM, Arcus urgently suspended withdrawals across the platform; half an hour later at 11:37, a vulnerability patch was deployed in real-time; at 11:43, the malicious address was fully banned.

From the reopening of withdrawals at 4:26 AM the next day to the noon replenishment of the 2.23 million USD deficiency by the company's treasury at 12:28 PM, this 14-hour crisis inadvertently became a stress test for the Arcus system.

Perpetual Contract Trading Volume of 9.918 Billion USD in the Last 30 Days

Arcus was created in collaboration between the dYdX Labs team and Robinhood Crypto, with Robinhood Crypto being the strategic investor. This perpetual contract platform launched on the Robinhood Chain (an L2 based on Arbitrum) in July 2026, providing 24-hour zero-fee spot trading for stock tokens, as well as perpetual contracts for cryptocurrencies, stocks, indices, and commodities (currently still in the Beta phase, with some features requiring invitations or phased openings).

Arcus CEO and founder Eddie Zhang previously founded the social trading application Pocket Protector, which was acquired by dYdX Labs in July 2025, after which Zhang served as president of dYdX. dYdX founder Antonio Juliano has joined the Arcus board. The platform is not a rebranding or migration of dYdX, and the dYdX Chain continues to operate independently.

According to the latest data from DefiLlama, Arcus's TVL remains around 64 million USD, with the spot trading volume reaching 74.42 million USD in the last 30 days, while the perpetual contract trading volume in the past 30 days hit 9.918 billion USD.

Notably, it features multi-asset properties.

In the perpetual contract market of Arcus, not only do mainstream crypto assets like Bitcoin and Ethereum dominate, but the trading activity of QQQ (Nasdaq 100 Index ETF) and SPY (S&P 500 Index ETF) closely follows, with daily trading volumes exceeding 50 million USD.

This aggregation of liquidity across asset classes not only positions it as a bastion connecting traditional finance and the crypto market but also inevitably makes it a juicy target for advanced yield farmers and arbitrage funds.

The official has not yet announced any token plans, and Antonio Juliano previously mentioned that if an Arcus token exists in the future, a portion of allocation may be reserved for the dYdX community.

It is noteworthy that this incident costing 2.23 million USD likely originated from an unexpected event caused by a "yield farmer." On October 1, Arcus had just loudly launched a points program.

For crypto users well-versed in this practice, frequently moving funds between sub-accounts to inflate volumes is a common witching strategy. However, the platform's fragile bookkeeping logic could not withstand this pressure, allowing a new account that originally intended to earn points to inadvertently execute a code for infinite money printing.

In a sense, this accidental player acted more like a part-time security tester with their own provisions, harshly pulling down the veil of the platform's risk control.

Arcus's incident, attributed to a single account's inflated withdrawals due to internal bookkeeping logic flaws, differs from typical hot wallet private key leaks or cross-chain bridge contract vulnerabilities, but it similarly exposes the risk control boundaries in scenarios involving high-frequency transfers, sub-accounts, and cross-chain bridge limits.

The official report revealed that monitoring and limits quickly restricted the expansion of losses, with withdrawal suspensions lasting about several hours, and normal operations have resumed after the fix.

For a platform still in the Beta phase, with the points program and multi-asset collateral features being intensively advanced, this incident provided an internal stress test. User assets were not directly harmed, but the event also highlights that even in products positioned as self-custodial, the system boundaries for ledger reconciliation and withdrawal risk control may still become weak points.