Arbitrum Security Council moved exploit funds using an unsigned mechanism
Security & Exploits ·
The Security Council froze ETH and ARB tied to the Binance exploit by substituting the sender of a cross-chain message, without ever holding the exploiter's private key.
An Ethereum transaction recorded in block 26,301,886 at 00:08:35 UTC on October 30, 2026 carried out Arbitrum's emergency response to funds connected to the Binance exploit, according to defiprime.com. The council's notice states it redirected 8,425 ETH and 74,559,805.2 ARB into a separate holding address, reaching a total described elsewhere in the cluster as roughly $30 million moved without access to the hacker's private key. The transaction's destination was 0xf06e95ef589d9c38af242a8aaee8375f14023f85, and the Inbox contract at 0x4dbd4fc535ac27206064b68ffcf827b0a60bab3f logged four separate implementation-change events in the course of the single transaction.
The method involved briefly swapping out the Inbox contract's code, issuing cross-chain messages that appeared to originate from the exploiter's address, then reverting the contract to its original state — all inside one atomic Ethereum transaction, per defiprime.com. The implementation addresses alternated between 0x980d1f93fc5809c828539c46084801673fa6a859 and 0x7c058ad1d0ee415f7e7f30e62db1bcf568470a10, and both associated message events named 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5 as sender