Arcus drained of 2,234,391 USDG as underflow bug inflates fake balance

Arcus, a decentralized exchange running on Robinhood Chain, watched 2,234,391 $USDG walk out the door after a freshly created account talked its own balance into a number it never deposited. The cash left in nine separate BridgeVault transfers to a wallet the exchange has since published. Security firm CertiK pins the cause on an integer underflow — the arithmetic glitch where a value slips below zero and wraps into something enormous, like an odometer spinning backward past zero and landing on 999,999.

The damage had a ceiling nobody set on purpose. An on-chain rate limit caught the withdrawals three minutes into the exploit, blocking an estimated $3 million in additional requests. Those held-up withdrawals were reversed once the fix shipped, leaving the exploiter with the $USDG that had already cleared and nothing more. CertiK is careful about that 2,234,391 figure: it counts tokens moved, not an independently valued dollar loss or a verified measure of attacker profit.

Timing tells the sharper story. The trouble began around 10:07 p.m. ET on November 9, 2026, when the new account abused flaws in how Arcus handled transfers between subaccounts to inflate its balance. Arcus's own incident report carries the November 9 date, while CertiK notes the ledger activity and on-chain executions landed November 10 UTC — the same night, just a different calendar on the other side of the Atlantic. Monitoring flagged the problem at 10:15 p.m., the rate limit had already engaged at 10:10, but the platform-wide pause didn't arrive until 11:07 p.m., nearly an hour after the alarm.

Arcus says it covered the shortfall from its company treasury. According to the research findings, no other users' funds were hurt and operations were back online within hours — running again by early the next morning. The exchange also published the exploiter's address and is working with blockchain investigators to trace the funds. It reportedly offered a bounty in exchange for returning a substantial share of the tokens; whether the offer was taken up is unknown.

The incident has been labeled an internal accounting error rather than a smart-contract security failure — a pointed detail, since audits tend to circle contracts while the weak spot sat in subaccount bookkeeping. Arcus is a DEX aligned with the dYdX team and settles payouts in $USDG through its BridgeVault. As of November 13, 2026, there were no reports of broader market contagion, and the damage stayed contained to Arcus itself.

What's left to watch is concrete: whether the exploiter accepts the bounty and returns a meaningful chunk of the tokens, whether Arcus publishes a fuller technical postmortem on how the underflow slipped through and what checks were added, and whether other venues on Robinhood Chain take a hard look at their own bridge rate limits. A three-minute automated save against an hour-long manual pause makes that last one an easy argument.