A newly created account found a flaw in how Arcus, the tokenized stocks and perps DEX on Robinhood Chain, handled transfers between a user's own subaccounts. Under specific conditions the bug let it record a balance far larger than it held, and the account then withdrew against it, as detailed in the Arcus incident report.

$2,234,391 USDG left on-chain before withdrawals were stopped, while the bridge's rate limit held back a further $3M that was never paid out and later reversed.

The exploit started around 10:07 PM ET on November 9. The team paused withdrawals an hour later, deployed a fix at 11:37 PM and blocked the exploiter's addresses. Withdrawals reopened the next morning, and Arcus Labs covered the shortfall from its treasury, so no user balances or positions were affected.

Arcus is working with blockchain investigators to trace the funds and has published the exploiter's initial address, asking exchanges to flag any deposits from it.