Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key

Arbitrum’s Security Council moved over 8,425 ETH and 74 million ARB out of an address tied to the Binance exploit last Friday without any action on the hacker’s part.

At current prices that’s roughly $30 million, a rounding error next to the roughly $6.3 billion taken from Binance.

Arbitrum is a network that runs on top of Ethereum to make transactions cheaper, and it holds billions of dollars in user deposits. On any blockchain, a wallet’s funds move only when its private key, a secret number known only to the owner, signs off on the transfer.

The Security Council is a 12-member group elected by holders of the ARB token, with emergency powers to upgrade the network’s contracts if nine of them agree.

It used those powers in an unusual way on Friday. The council’s Safe, a shared wallet that needs nine signatures, sent one Ethereum transaction that temporarily swapped the code of Arbitrum’s Inbox, the contract that carries messages from Ethereum into Arbitrum.

The replacement code added a function called sendUnsignedTransactionOverride, which let the council send transactions that Arbitrum treated as coming from the exploiter’s address.

Two such transactions moved the ARB and the ether to a holding address ending in 0DA0, and the original Inbox code was restored in the same transaction, according to the council’s notice on the Arbitrum governance forum.

“No other user’s funds or applications were affected,” the notice said. The funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.”

Security firm Zealynx traced the transactions and said the funds arrived on Arbitrum about 10 minutes after the Ethereum transaction as type 0x65 transactions with blank signature fields, and they used the exploiter address’s own transaction counter.

The council “used powers the DAO gave it and published both actions within an hour and a half,” the firm wrote, adding that the assumption an address only moves when its key signs holds “up to whoever controls the upgrade path.”

That’s a big caveat, however, for a network that markets itself as decentralized, and means that whoever controls the upgrade path can make any address on Arbitrum spend.

The council has done this before. In April it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker.

Getting that ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave.

The FBI attributed the Binance hack to the country’s TraderTraitor group on Oct. 31.