Arbitrum Security Council Freeze: How It Worked

The Arbitrum Security Council froze about $30 million in ETH and ARB linked to the Binance exploit on 30 October 2026 by temporarily rewriting a contract on Ethereum, and it did so without holding the attacker's private key. The action recovered a small slice of a roughly $6.3 billion incident, but it matters more as a case study: it shows how much emergency power sits behind a network that many allocators treat as decentralised infrastructure.

This article looks at what the council did, how the mechanism works, who can release the funds and what the episode means for counterparty risk. For the wider incident, see our Binance hack explainer.

What did the Arbitrum Security Council do?

According to the council's emergency notice as reported by TFTC and DeFi Prime, the council moved 8,425 ETH and 74,559,805.2 ARB from an address tied to the exploit into a holding address on Arbitrum One. Outlets value the total at roughly $30 million to $30.5 million, depending on the price used.

The sequence, as described in those reports:

A 9-of-12 emergency multisig called Arbitrum's upgrade executor on Ethereum at block 26,301,886 (about 00:08 UTC).
The council temporarily replaced the implementation of the Inbox contract with a version containing a function called sendUnsignedTransactionOverride.
That function sent cross-chain messages that impersonated the exploiter's address, producing unsigned transfers on Arbitrum One.
The original Inbox code was then restored.

The council stated that no other user's funds or applications were affected. DeFi Prime independently checked the ARB leg on-chain and found the transfer carried zero signature values, consistent with an unsigned transaction. It did not independently measure the ETH leg.

How does the Security Council freeze funds without a private key?

Arbitrum is a layer-2 network, and its rules are enforced by contracts that the DAO and the Security Council can upgrade. The constitution gives both bodies chain-owner privileges. The Security Council can act in an emergency with nine of twelve signatures and no time delay, and it is expected to publish a full transparency report afterwards, per DeFi Prime.

The Inbox is the contract through which transactions enter the chain from Ethereum. By adding a function that lets a caller construct a message that appears to come from any sender, the council could move assets without a signature. TFTC notes that no on-chain rule limits which addresses that function can target, so the limit is the council's judgment and the DAO's after-the-fact oversight.

This is not a bug. A security researcher quoted by TFTC said the council "used powers the DAO gave it". It is the design working as intended, which is exactly what allocators should understand when they assess the network.

Who can release the frozen funds?

The council's notice says the funds can only be moved by an ArbitrumDAO governance vote, coordinated with relevant parties. No recipient, legal claimant or proposal had been named as of the notice.

DeFi Prime outlines how slow that route can be. A proposal needs a proposer with at least 1,000,000 delegated tokens, a three-day period before the snapshot, and normally a 14-day vote. Execution then adds waiting periods that vary by route. In practice, the assets are likely to stay in place for weeks at least.

Why does this matter for counterparty risk?

The freeze is a useful outcome for the victims, but it is also a reminder that "decentralised" describes a spectrum. Three points stand out.

Precedent. TFTC reports the council used the same mechanism in April 2026 against a KelpDAO exploiter, moving 30,766 ETH. That earlier action followed law-enforcement identification of the attacker. This one came within hours of the exploit, before any legal process.
Signer concentration. Nine signers can change how the chain treats any address. Users carry some exposure to those signers' judgment and to outside pressure on them.
Scope of discretion. The power is not technically restricted to exploiters. Whether that matters depends on how much trust one places in the council's norms and in DAO oversight.

None of this means the action was wrong. Many users will welcome a recovery mechanism. The point is that it is a trade-off between recoverability and credible neutrality, and it should be priced into how an allocator assesses venues and assets on the network.

How does it compare with other freezes in the incident?

The council's $30 million is small beside what centralised issuers did. The Hacker News reports that Tether reportedly froze more than 1.567 billion USDT and Circle about 800 million USDC, and that Binance said it had traced and frozen around $3 billion on-chain. The same report says the attacker still controls roughly $3.33 billion that issuers cannot freeze.

Those issuer freezes rest on contract-level controls built into the tokens. They are part of the reason regulators are writing reserve and redemption rules for stablecoin issuers, which we covered in the Fed's GENIUS Act proposal. The Arbitrum case applies similar logic at the network layer, where no issuer exists.

Attribution of the Binance incident is also not settled. TRM Labs and Chainalysis linked it to North Korea-associated actors with high confidence, while Elliptic urged caution, per The Hacker News.

What to watch

Whether the DAO publishes a proposal to release, return or hold the frozen assets, and who it names as recipient.
Whether delegates propose limits on the Inbox override power or on the council's emergency scope.
Whether the council's required transparency report adds detail on the decision process.
How other layer-2 networks with emergency committees respond, and whether regulators treat such powers as relevant to the wider market structure debate.

Scenarios here are possibilities, not forecasts. A DAO vote could return the assets, keep them frozen or be contested, and each outcome carries legal and governance risks for the network.

Sources

This article is for informational purposes only and does not constitute financial, investment, legal or tax advice, or an offer or solicitation to buy or sell any asset or fund interest. Digital assets are highly volatile and you may lose some or all of your capital. Past performance is not indicative of future results.