Arbitrum’s Security Council moved about $30 million of funds tied to the Binance hack on Friday 30 October without the holder’s private key, CoinDesk reports. The money was 8,425 ETH and 74 million ARB. CoinDesk calls the address tied to the Binance exploit but does not explain how that link was established.
The 12-member council used its emergency upgrade powers, which need nine approvals. In one Ethereum transaction its multisig temporarily swapped the code of a core contract, moved the assets, and restored the original code.
The security firm Zealynx traced the transactions. The council posted a notice on the Arbitrum governance forum and says it acted within the powers the DAO gave it. Zealynx said the funds arrived on Arbitrum about 10 minutes later, using the exploiter address’s own transaction counter.
The assets now sit at a holding address. Only an ArbitrumDAO governance vote can move them from there, and that vote has not happened. The FBI has since pointed to North Korea’s TraderTraitor group for the Binance theft.
It is the council’s second such move this year. In April it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter, and the aftermath dragged on for weeks because families with unpaid terrorism judgments against North Korea tried to claim the funds.
Zealynx’s conclusion is that the assumption that an address moves only when its key signs holds only up to whoever controls the upgrade path.
For a chain that markets itself on decentralisation, the question is not whether the council meant well. It is how many more times it will be asked, and by whom.
