-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0338
============================================================

Advisory-ID:  0xCERT-2026-0338
Severity:     High
Published:    2026-11-10T17:28:00.000Z
Updated:      2026-11-11T04:43:21.565Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0338

Title: Arcus Perps on Robinhood Chain: subaccount accounting bug exploited to withdraw 2.23M USDG; shortfall covered

Summary
- -------
An accounting bug in Arcus Perps subaccount transfers let an attacker inflate a balance and withdraw 2,234,391 USDG on 9-10 Nov 2026; ~$3M more was held by the bridge rate limit and reversed. Arcus patched the bug and covered the shortfall. Exchanges should flag funds from the published exploiter address.

Details
- -------
Summary
Arcus, a self-custodial perpetuals DEX on Robinhood Chain, reports that a newly created account exploited an accounting bug in transfers between a user's own subaccounts at about 10:07 PM ET on 9 November 2026 (about 03:07 UTC on 10 November). The bug let the account record a balance far larger than it held and request withdrawals against it. 2,234,391 USDG was withdrawn on-chain before withdrawals were paused; a further ~$3M of requests was held by the bridge's withdrawal rate limit, never paid out, and reversed.

Affected
- - Arcus Perps exchange (subaccount transfer accounting)
- - Fixed: Arcus deployed a fix at 11:37 PM ET on 9 November; withdrawals were re-enabled at 4:26 AM ET on 10 November

Impact
Per Arcus, the shortfall of 2,234,391 USDG was covered from the Arcus Labs company treasury at 12:28 PM ET on 10 November, and no user balances, positions or orders were affected. The exploiter's addresses were blocked from trading, transferring and withdrawing. Exploitation is confirmed. Arcus says the withdrawn funds are being tracked on-chain and it will coordinate with law enforcement as appropriate.

Recommended actions
- - Arcus users: no action required, per Arcus.
- - Exchanges and service providers: flag and screen funds received from the exploiter address below, as Arcus requests.

Indicators
Arcus published one address, described as "the initial address of the exploiter"; it states other exploiter addresses were blocked but did not list them. Arcus did not name the network for this address.

Source & attribution
This 0xCERT advisory summarises Arcus's incident report (https://arcus.xyz/blog/arcus-incident-report-november-9-2026), corroborated by DefiLlama's hacks dataset and DeFi Prime's report (https://defiprime.com/arcus-subaccount-bug-withdrawals). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://arcus.xyz/blog/arcus-incident-report-november-9-2026
- - https://defiprime.com/arcus-subaccount-bug-withdrawals
- - https://www.techflowpost.com/en-US/newsletter/144049

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0Fgmr0qaMJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmceHQaGl9Dz4taBf7DiY0Z3dVOPDULjEzaefzJO
KRKo2BYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABbaAD+Jl3fcswAMBnB0ps9
5zVQLUPb5WNziUyYqd7QkQ9H4rEBALDD4KXrPU34WpnnPFn32tH9qUGXg4SC
v561bkmCY/0G
=xq0l
-----END PGP SIGNATURE-----