Arbitrum Security Council Moves About $30.45 Million of Stolen Binance Funds Without Private Keys

Written by: TechFlow

At 08:08 Beijing Time on October 30, 2026, the Arbitrum Security Council transferred 8,425 ETH and 74,559,805.2 ARB from addresses linked to the Binance theft on Arbitrum One to an address whose funds can only be moved by ArbitrumDAO vote, without the attacker’s private keys. According to TechFlow’s calculation, the assets were worth about $30.45 million at 15:54 Beijing Time on November 3, accounting for about 0.48% of the roughly $6.3 billion in affected funds from the Binance theft.

How the Security Council Moved Funds Without Private Keys

According toArbitrum Security Council forum announcement, the council performed an atomic upgrade of the Inbox contract on Ethereum: it added the function sendUnsignedTransactionOverride, used it to construct two cross-chain transactions impersonating the stolen addresses, transferred the funds to 0x0000000000000000000000000000000000000DA0, and then restored the Inbox to its original implementation, all within the sameEthereum transactionwas completed, in block 26,301,886, at 00:08:35 UTC on October 30. The announcement said: “No other users’ funds or applications were affected.”

According to CoinDesk, the Security Council consists of 12 members elected by ARB holders, and emergency operations require signatures from 9 of them. Security firm Zealynx, inEthereum Wizards Forum on-chain analysiswrote that, about 10 minutes after the Ethereum transaction was executed, two type 0x65 transactions were included on Arbitrum One, with signature fields r, s, and v all zero, using the stolen addresses’ own second and third nonces.

On Arbitrum, whether funds at an address can be moved ultimately depends on 9 signatures from the 12-member council that controls the upgrade path; the private key is just one gate. In Zealynx’s words, “an address only moves with a private-key signature” holds only for those subject to the people who control the upgrade path.

What was frozen was all of Binance’s stolen assets on Arbitrum

According to TechFlow’s earlieron-chain post-mortem, the attacker transferred all 8,426 ETH and 74.6 million ARB stolen from Binance on Arbitrum to a new wallet beginning with 0x3e2b between 05:35 and 05:38 Beijing Time on October 30; the impersonating sender recorded by Zealynx was exactly this address. According to TechFlow’s calculation, the Security Council acted about 2.5 hours after the funds entered that wallet, freezing all of Binance’s stolen assets on the chain.

TechFlow queried an Arbitrum public node and found that, as of 15:54 Beijing Time on November 3, the 0DA0 address held 8,426.05 ETH and 74,559,805.2 ARB. Based on CoinGecko prices at the same time (ETH at $2,255.38 and ARB at $0.1535), the total was worth about $30.45 million.

April precedent: releasing funds faced legal obstacles

According toApril forum announcement, the ETH frozen in that incident was also transferred to the 0DA0 address. On April 25, five parties, including Aave Labs, submitted a proposal seeking to use it to compensate rsETH holders. According to CoinDesk, the ETH was worth approximately $71 million at the time; families holding North Korea terrorism damages judgments had attempted to claim the funds. The DAO voted to transfer the funds to Aave only after a federal judge in Manhattan modified a restraining order. According to TechFlow's estimate, the two freezes totaled approximately 39,192 ETH.

The U.S. Federal Bureau of Investigation (FBI) attributed the Binance theft case to the North Korean hacker group TraderTraitor on October 31. The Arbitrum governance forum will hold a proposal discussion at 00:00 (Beijing Time) on November 4; this emergency operation is listed only under the 'Quick Updates' item. As of 16:00 (Beijing Time) on November 3, no proposal to release these funds has been posted on the forum.

Source: TechFlow