On the night of 9 November 2026 a newly created account on Arcus withdrew 2,234,391 USDG on-chain. The company’s incident report, dated 10 November, puts that withdrawal at about 10:07 p.m. Eastern, which is 03:07 UTC on 10 November. It says the account used a bug in transfers between a user’s own subaccounts, and that the transfer was recorded as a balance larger than the account held. Only that one account. Withdrawals were stopped before a further about $3 million of requests was paid. That second pile was held by the bridge’s rate limit, never sent, and later reversed. Arcus says no other balances, positions, or orders were affected, and that it covered the shortfall from the Arcus Labs treasury. This page will not describe the bug past that sentence, and it will not publish the address the report names.
The report calls Arcus the exchange. Other outlets describe it as a venue on Robinhood Chain. This page uses the report’s word. The number on the screen is a claim on the company. What is a crypto exchange balance?. A transfer between a person’s own subaccounts is bookkeeping inside that claim. When the book records more than the account held, a withdrawal can pay out money that was not there. That is an exchange ledger. It is not a chain minting a dollar.
What happened
The report’s clock is Eastern time on the night of 9 November into the morning of 10 November. At about 10:10 p.m. the rate limit held the further about $3 million. At 10:15 p.m. monitoring flagged the activity. At 11:07 p.m. withdrawals were paused across the platform. At 11:37 p.m. a fix was deployed. At 11:43 p.m. the account was blocked from trading, transferring, and withdrawing. At 4:26 a.m. on 10 November withdrawals were switched back on. At 5:02 a.m. the pending withdrawals from that account, the ones that had never been paid, were reversed. At 12:28 p.m. the shortfall was covered from the Arcus Labs treasury. Arcus says the fix was reviewed by security partners, and that trading and withdrawals are operating normally.
Two piles should stay separate. The 2,234,391 USDG left the platform. The about $3 million did not. Adding them invents a loss the report does not claim. A treasury cover is the company paying the gap. It is not the withdrawn USDG coming back. A review by security partners is a statement that a review happened. It is not a description of the bug, and this page will not add one.
Why it matters
If you had a balance on Arcus other than that one account, the report says your balance, your positions, and your orders were not the ones rewritten. The door that closed was withdrawals, from 11:07 p.m. Eastern until 4:26 a.m. A pause is not a theft of the accounts that were not the one account. If you never used Arcus, this page did not spend a wallet you hold. See How crypto wallets actually work.
The same shape, at a different size, is an exchange till that pays out and a company that says it will cover the gap. Binance puts the hot-wallet loss near $6.3 billion. Mercado Bitcoin says customers will not lose. Those are hot wallets. This is a bookkeeping bug inside one new account. The product fact is the same kind: the screen can show a number the coins do not match, until the company pays the difference. A message that offers to “restore” an Arcus balance, and asks for a recovery phrase, is not the incident report. See How do you keep crypto safe?.
What happens next
Whether the treasury cover is the last word, which the report says it has already done for the shortfall. Whether any of the 2,234,391 USDG is later recovered, which the report does not claim. Watch Arcus’s own report. We will not add the held $3 million to the USDG that left, and we will not treat a treasury payment as the withdrawn coins returned.
Not a recommendation to deposit, withdraw, or trade on Arcus. Not a finding that any other venue was hit. Not a description of the bug. The report’s own account is one account, a dollar figure that left, a larger figure that did not, and a treasury cover.
