Arbitrum's security council moved on Oct. 30, 2026. Nine of its 12 signers approved a single transaction on Ethereum. The council called a function that rewrote Arbitrum's Inbox contract for that one transaction. Engineers built that rewrite to let two transfers claim a hacker's address as their own sender1.
Those transfers moved 8,425 ETH and 74.6 million ARB, worth about $30 million, into a wallet the council controls. Investigators traced the address to the theft that drained Binance's hot wallets on Oct. 29, 2026, for about $6.3 billion. North Korea's TraderTraitor group sits behind that theft, the FBI said on Nov. 16. Binance's loss runs more than 200 times larger than the sum Arbitrum recovered1.
Read fast, the freeze reads as an unambiguous win. A rollup caught a state-backed hacker and pulled his loot back in minutes, faster than any court could act. Code did what a bank's fraud desk takes days to do, and it did so for free.
That reading skips the mechanism. The council left the hacker's own wallet untouched1. Its members rewrote Arbitrum's contract instead. The network then logged his address as the sender of two transfers the council itself wrote.
Zealynx Security traced the move block by block. The firm found the override worked within one Ethereum transaction, and finished inside ten minutes3.
Builders call this an upgrade. Users feel it as a committee writing a transaction in their name. The same mechanism reaches any address on Arbitrum, a hacker's or anyone else's.
Arbitrum's Oct. 30 freeze touched $30 million of its $9.46 billion in value secured
Dollars moved by the council vs. total value secured on Arbitrum One, L2Beat said Nov. 4, 2026
Sources: CoinDesk [1]; L2Beat (ethbeat.org) [5].
Read the chart as a table
| Item | Value |
|---|---|
| Oct. 30 freeze | $30M |
| Arbitrum One's value secured | $9,460M |
Steven Goldfeder co-founded Offchain Labs, the company that built Arbitrum. He defended the council's choice to skip a public vote before acting on the first freeze, in April. “If you say, 'hey guys, should we move these funds?' then you might as well do nothing,” Goldfeder said2.
Goldfeder's defense rests on speed. Tipping off a hacker before the council moves would hand him time to scatter the funds across other chains. His logic answers one question and skips another: why the same nine people get to decide, alone, every time a crisis arrives.
That first freeze targeted 30,766 ETH, worth about $71 million, tied to a KelpDAO exploiter. KelpDAO had lost $292 million to the same attacker weeks earlier. Patrick McCorry heads research at the Arbitrum Foundation. He called the council "a very transparent part of the system," elected by ARB holders every six months2.
The April money sat frozen for weeks after that vote of confidence. Families holding unpaid court judgments against North Korea tried to claim it before Arbitrum's DAO could vote on where it went. A Manhattan federal judge had to modify a restraining order first. Only then did the DAO send the ether to Aave1.
Arbitrum's security council has frozen crypto twice in 2026
Two emergency freezes by Arbitrum's security council, by date and dollar amount moved
Sources: CoinDesk [1]; CoinDesk [2].
Read the chart as a table
| Date | Event |
|---|---|
| April 21, 2026 | $71M frozen, KelpDAO exploiter |
| Oct. 30, 2026 | $30M frozen, Binance's hacker |
Charles Guillemet watched the same pattern from Ledger, where he serves as chief technology officer. He posted his read of the April freeze the day it happened. “Call the freeze what it is: a legitimate administrative intervention on an administered chain,” Guillemet wrote. He placed Arbitrum at what L2Beat calls Stage 1, a tier Optimism, Base, zkSync, Starknet and Linea all share too. “The Arbitrum freeze didn't break a promise, it revealed a promise we had already stopped keeping,” he wrote4.
Guillemet's sentence holds up against October's repeat. Optimism froze its own share of the Binance theft the same week Arbitrum did. Tether, Circle and Ripple froze theirs too, the FBI's own tally shows6. Regulators and rivals alike now point to that response as proof crypto can protect its users. Every one of those freezes ran on the same trade: a promise of neutral code that gave way the moment real money moved.
Code decided where $30 million went on Oct. 30, the same way a vote decided where $71 million went in April. Binance's hacker keeps his freedom while that money sits waiting on another vote. Arbitrum's nine signers gain the credit for catching him, credit they can claim again whenever they agree a crisis justifies it. Every other account on Arbitrum's $9.46 billion network carries the same exposure, since the mechanism that reached the hacker reaches them too5.
Arbitrum's council has frozen stolen crypto twice in 2026, both times by rewriting the code it tells users to trust. A vote decided where the money went on each occasion, and the signers' own judgment outweighed any private key on the network. The CryptoLately.com Desk tracks the next vote as closely as this one. Sign up for The Signal at cryptolately.com/newsletter to see it first.
Both sides, in their own words
Does a network stay decentralized when nine people can spend any wallet on it by vote?
“If you say, 'hey guys, should we move these funds?' then you might as well do nothing”
“Call the freeze what it is: a legitimate administrative intervention on an administered chain”
Sources
- Shaurya Malwa, "Arbitrum's council moved $30 million of Binance hack funds without the hacker's key," CoinDesk, Nov. 3, 2026, https://www.coindesk.com/tech/2026/11/03/arbitrum-s-council-moved-usd30-million-of-binance-hack-funds-without-the-hacker-s-key
- Margaux Nijkerk, "Inside the $71 Million Freeze on Arbitrum That Has the Crypto World Questioning What Decentralization Really Means," CoinDesk, Apr. 22, 2026, https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means
- Unchained, "Arbitrum's Security Council Can Move a Wallet's Funds Without Its Key, Binance Freeze Shows," Unchained, Nov. 2, 2026, https://unchainedcrypto.com/arbitrums-security-council-can-move-a-wallets-funds-without-its-key-binance-freeze-shows/
- Charles Guillemet, Post on X, X, Apr. 21, 2026, https://x.com/P3b7_/status/2046570795787321729
- L2Beat, "Scaling summary: rollups value secured," L2Beat (ethbeat.org), Nov. 4, 2026, https://ethbeat.org/scaling/tvl
- Al Jazeera Staff, "FBI blames North Korea for record $6.3bn crypto heist from Binance," Al Jazeera, Nov. 1, 2026, https://www.aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist