Arcus Perps on Robinhood Chain: subaccount accounting bug exploited to withdraw 2.23M USDG; shortfall covered

Summary

Arcus, a self-custodial perpetuals DEX on Robinhood Chain, reports that a newly created account exploited an accounting bug in transfers between a user's own subaccounts at about 10:07 PM ET on 9 November 2026 (about 03:07 UTC on 10 November). The bug let the account record a balance far larger than it held and request withdrawals against it. 2,234,391 USDG was withdrawn on-chain before withdrawals were paused; a further ~$3M of requests was held by the bridge's withdrawal rate limit, never paid out, and reversed.

Affected

• Arcus Perps exchange (subaccount transfer accounting)
• Fixed: Arcus deployed a fix at 11:37 PM ET on 9 November; withdrawals were re-enabled at 4:26 AM ET on 10 November

Impact

Per Arcus, the shortfall of 2,234,391 USDG was covered from the Arcus Labs company treasury at 12:28 PM ET on 10 November, and no user balances, positions or orders were affected. The exploiter's addresses were blocked from trading, transferring and withdrawing. Exploitation is confirmed. Arcus says the withdrawn funds are being tracked on-chain and it will coordinate with law enforcement as appropriate.

Recommended actions

• Arcus users: no action required, per Arcus.
• Exchanges and service providers: flag and screen funds received from the exploiter address below, as Arcus requests.

Indicators

Arcus published one address, described as "the initial address of the exploiter"; it states other exploiter addresses were blocked but did not list them. Arcus did not name the network for this address.

Source & attribution

This 0xCERT advisory summarises Arcus's incident report (https://arcus.xyz/blog/arcus-incident-report-november-9-2026), corroborated by DefiLlama's hacks dataset and DeFi Prime's report (https://defiprime.com/arcus-subaccount-bug-withdrawals). Details may change; refer to the original source for the authoritative record.