Arcus, a decentralized exchange operating on Robinhood Chain, paid 2,234,391 USDG to an exploiter after a flaw in subaccount transfers allowed a newly created account to inflate its balance. CertiK attributed the incident to an integer underflow rather than a weakness in the smart contracts. An automated bridge rate limit blocked an estimated $3 million in additional withdrawals before the platform suspended withdrawals and deployed a fix. Arcus covered the shortfall from its treasury, said no other users’ funds were affected and resumed withdrawals on November 10, 2026. It published the exploiter’s address and reportedly offered a bounty in exchange for returning a substantial portion of the tokens, but it remains unknown whether the offer was accepted.
Source: Read the original article
