A walkthrough posted to the Ethereum Magicians forum shows how the Arbitrum Security Council emptied an address tied to the Binance exploit on Oct. 30 without ever holding its private key.

The council took 74,559,805 ARB and about 8,426 ETH off the address, moving both to a holding address.

The 9-of-12 council Safe briefly swapped the code of Arbitrum's Inbox contract through the UpgradeExecutor, so the transfers appeared to be sent by the address itself, then restored the original code. On-chain, the moves show up only as type 0x65 transactions with blank signatures.

The funds can only move again through an ArbitrumDAO governance vote. Security firm Zealynx sees no bug in the design, but notes that on such chains a key only controls a wallet as far as whoever controls the upgrade path allows. The council made a similar move in April with 30,765 ETH held by the KelpDAO exploiter.