Arbitrum’s Security Council has moved roughly $30 million in cryptocurrency from an address linked to the Binance hack, even though it did not control the private key for that wallet. The transfer was carried out through an emergency intervention that temporarily altered one of the network’s core contracts, allowing the council to spend from the address before restoring the original code.
The action required approval from nine members of Arbitrum’s 12-person council. It marks the second use of this type of emergency power on Arbitrum this year and underscores the extent to which the system’s safeguards can, in extraordinary cases, override direct user control of funds.
How the transfer was executed
According to the source report, the council briefly rewrote a core Arbitrum contract so it could move assets from an address for which it held no key. After the transfer, the original contract code was put back in place.
Security firm Zealynx traced the transactions and said the funds reached Arbitrum shortly after the Ethereum transaction. Zealynx also noted that the movement used the exploiter address’s transaction counter along with blank signatures.
Funds now held pending governance
The recovered assets have been placed in a holding address. From there, they cannot be moved again unless ArbitrumDAO approves a governance vote.
That next step may not be immediate. The report said ArbitrumDAO’s process has already encountered legal delays following a similar asset recovery carried out earlier this year.
Second emergency intervention this year
This is the second known instance in 2026 in which Arbitrum’s council used emergency authority to seize control of assets linked to an exploit. In April, the council used similar powers to move about 30,766 ETH from the KelpDAO exploiter.
At the time of that earlier action, the ether was worth around $71 million. The latest intervention therefore adds to a growing record of cases in which Arbitrum’s emergency governance tools have been used to recover funds tied to high-profile attacks.
Binance hack link and what comes next
The address targeted in the latest operation was linked to the Binance hack. On Oct. 31, the FBI attributed that hack to TraderTraitor, according to the report.
For now, the confirmed next step is governance. The assets remain in the holding address until ArbitrumDAO decides whether and how they should be moved, a decision that may be shaped by the same procedural and legal issues that affected the earlier recovery.
Source: www.coindesk.com