Arbitrum Moved $30M Without the Hacker's Private Key: 9 Signatures, 2 Forced Transfers — Is Your Crypto Really Yours?

Payoff First: 9 People Just Moved $30 Million Without a Private Key

Arbitrum's Security Council moved more than 8,425 ETH and 74 million ARB — roughly $30 million — out of an address linked to the $6.3 billion Binance hack without ever holding the hacker's private key. It took nine signatures, one temporary code swap, and two forced transfers. And it worked. If you hold crypto on Arbitrum, or on any network with an emergency upgrade council, this story is about your money too — because it proves the rule every crypto beginner is taught, "only your key can move your coins," comes with a footnote nobody reads: up to whoever controls the upgrade path.

That is not a conspiracy theory. It is what Arbitrum's own council disclosed on its governance forum, what security firm Zealynx traced on-chain, and what CoinDesk reported on November 3, 2026. The council says no ordinary user's funds were touched, and the recovered money now sits in a holding address that can only be moved by a vote of ArbitrumDAO. But the same mechanism that recovered $30 million from a thief could, in principle, move funds from any address on the network. Understanding that mechanism — and what it means for where you keep your crypto — is the whole point of this article.

What Actually Happened on Friday

On October 29, 2026, Binance suffered the largest exchange theft in crypto history: roughly $6.3 billion drained across multiple blockchains. On October 31, the FBI attributed the attack to TraderTraitor, a hacking group linked to North Korea, and urged crypto infrastructure providers to block transactions tied to the identified wallets. Some of the stolen funds landed on Arbitrum, Ethereum's largest Layer 2 network, where they sat in an address the exploiter controlled.

Then, on Friday, October 30, Arbitrum's Security Council acted. The council is a 12-member group elected by holders of the ARB token. Under Arbitrum's constitution it holds emergency powers: if nine of its twelve members agree, it can upgrade the network's contracts immediately, without waiting for a full governance vote. That is exactly what it did.

Here is the sequence, as described by the council and traced by Zealynx:

• The council's shared Safe wallet — a wallet that itself requires nine signatures — sent a single Ethereum transaction that temporarily replaced the code of Arbitrum's Inbox contract, the contract that carries messages from Ethereum into Arbitrum.
• The replacement code added a function called sendUnsignedTransactionOverride, which let the council submit transactions that Arbitrum treated as if they had come from the exploiter's own address.
• Two such transactions moved the 8,425 ETH and 74 million ARB to a holding address ending in 0DA0.
• The original Inbox code was restored within the same Ethereum transaction, so the override existed only for that moment.
• Zealynx traced the funds arriving on Arbitrum about 10 minutes later, as type 0x65 transactions with blank signature fields, using the exploiter address's own transaction counter.

The council said no other user's funds or applications were affected, and that it published both actions within about an hour and a half. The recovered assets, it said, can only be moved further by an ArbitrumDAO governance vote coordinated with the relevant parties. In other words: the money is frozen in place until token holders vote on what to do with it.

The $30 Million in Context: Big Power, Small Recovery

Before drawing sweeping conclusions, keep the scale honest. Roughly $30 million is about 0.5% of the roughly $6.3 billion stolen from Binance. This single intervention did not make victims whole, and it was never going to. Binance itself has said it will cover customer losses from its own reserves, and the bulk of the stolen funds moved through other chains, bridges, and mixers long before Friday's action.

What makes the $30 million matter is not its size. It is the precedent. This was the second time Arbitrum's council has used this power: in April 2026 it moved 30,766 ETH — then worth about $71 million — from the KelpDAO exploiter after law enforcement identified the attacker. And the aftermath of that earlier recovery shows why the governance-vote lock matters: CoinDesk reports that the process of returning recovered funds faced legal delays after the April case, with disputes over claims on the money. Recovering crypto and returning it to the right people are two very different problems, and the second one can take months.

There is also a second, quieter precedent in the same week. Stablecoin issuers Tether, Circle, Ripple, and others froze hack-linked funds of their own — but that is a different power entirely. A stablecoin issuer can freeze its own token because its token contract includes a blacklist function. Arbitrum's council did something broader: it made an address spend without its key, on a network whose users generally believe no one can do that.

The Myth This Breaks: "Nobody Can Move My Crypto Without My Key"

Every beginner guide — including ours — teaches some version of this rule: your private key is the only thing that can authorize a transaction from your address. On Bitcoin's base layer, that is essentially true. Nobody, not a council, not a company, not a government, can forge a Bitcoin signature. That is why Bitcoin's design is so stubbornly simple.

But most crypto activity does not happen on Bitcoin's base layer. It happens on smart-contract platforms, Layer 2 networks, and token contracts, where upgrade keys, admin keys, proxy contracts, and emergency councils exist by design. Zealynx put the caveat better than anyone: the assumption that an address only moves when its key signs holds "up to whoever controls the upgrade path." Whoever controls the upgrade path can, in the extreme case, make any address on that network spend.

That does not mean Arbitrum is about to seize your funds. The council acted under powers the DAO itself granted it, disclosed the action publicly within about 90 minutes, and locked the recovered money behind a governance vote rather than pocketing it. The risk is not that twelve elected volunteers will wake up tomorrow and drain the network. The risk is structural: the power exists, it is concentrated in nine signatures, and it has now been used twice in seven months. Once a power is used twice, it is a policy, not an exception.

Ask yourself the question the other way around. If a council can move a thief's funds without a key, what stops a future council — under government pressure, a court order, or a different political climate — from moving someone else's? The honest answer is: nothing technical. Only governance, transparency, and the willingness of token holders to watch what the council does. That is a social defense, not a cryptographic one, and social defenses fail more often than math does.

Who Can Actually Move or Freeze Your Crypto? The Comparison Table

This is the part most articles skip, so here it is plainly. Your protection depends entirely on where your crypto lives:

Where your crypto sits	Who can move or freeze it without your key?	How?
Bitcoin on-chain, self-custody	Essentially nobody	No upgrade council, no admin key; only your signature spends it
Arbitrum (and similar upgradeable Layer 2s)	Security Council with 9-of-12 signatures	Emergency contract upgrade can override an address, as shown twice in 2026
USDT, USDC and other freezable stablecoins	The token issuer	Built-in blacklist/freeze function in the token contract
Any token on an upgradeable proxy contract	The contract admin or upgrade key holder	Proxy upgrade can change the token's rules entirely
Funds on a centralized exchange	The exchange itself	It holds the keys; it can freeze withdrawals, as users saw after the Binance hack
Hardware wallet, self-custody	Nobody, unless you lose the seed or sign a malicious transaction	Your key, your device — but phishing and fake approvals remain your biggest risk

The pattern is simple: the more convenience and recoverability a platform offers, the more third parties stand between you and your coins. Arbitrum's emergency power is the Layer 2 version of that trade-off. It bought back $30 million from a thief. It also proved, on-chain and in public, that the network is not as permissionless as its marketing suggests.

What This Means for ARB Holders and Arbitrum Users

First, do not panic-sell ARB on this news alone. The council's action was disclosed, targeted, and arguably popular: recovering stolen funds from a North Korea-linked hack is the easiest possible case for emergency powers. Markets have seen this movie before — the April KelpDAO recovery did not break Arbitrum — and the network continues to process transactions normally for everyone else.

Second, do not ignore it either. The right response is to re-price the risk of holding large balances on any upgradeable network. If you keep life-changing money on Arbitrum, or any Layer 2, you are trusting not just code but a committee. That committee has now shown it will act, quickly, and that its actions are legal within the network's own rules. Whether you are comfortable with that is a personal decision, but it should be a conscious one — not something you discover from a headline.

Third, watch the governance vote. The $30 million now sits in a holding address that only an ArbitrumDAO vote can unlock. How that vote goes — who claims the funds, how long it takes, whether courts get involved as they did after April — will tell you more about decentralized governance than any whitepaper. If the money ends up tied up in legal disputes for months, that is itself a lesson: recovery is not restitution, and a frozen thief's wallet is not the same as a refunded victim.

Why the FBI Angle Changes the Stakes

The council did not act in a vacuum. The FBI, together with the Secret Service and IRS Criminal Investigation, explicitly asked crypto infrastructure providers — THORChain among them — to refuse transactions from wallets tied to TraderTraitor. That request puts every bridge, Layer 2, and DeFi protocol in an awkward spot: stay fully permissionless and risk becoming the laundering route for a state-sponsored theft, or intervene and admit that permissionlessness has limits.

Arbitrum chose intervention, through its own constitutional process rather than by quietly complying with a letter. That distinction matters. A council acting under published rules, with public disclosure, is very different from a company freezing accounts in secret. But it also sets a template other networks may now feel pressure to follow — and the next request may not come with a $6.3 billion, North Korea-attributed hack attached. It may come with a far greyer case, and the precedent will already exist.

This is also why the THORChain episode from the same week is worth remembering: a 10 ETH double-refund bug accidentally halted swaps across most of THORChain's chains and, according to Chainalysis, inadvertently delayed the same laundering effort. One network stopped the hackers by accident; another stopped them on purpose. Both stories point the same way: the "unstoppable" plumbing of crypto is, in practice, stoppable — sometimes by bugs, sometimes by committees, sometimes by issuers freezing tokens.

Checklist: 7 Moves Before You Trust Any Network With Serious Money

Use this before you park a large balance anywhere new:

1. Find the upgrade key. Does the network or token have an admin key, proxy admin, or emergency council? If you cannot find the answer in five minutes, assume the answer is yes.
2. Count the signatures. How many people must agree to use emergency powers? Arbitrum needs 9 of 12. Smaller quorums mean faster action — and less protection.
3. Check the precedent. Has the power been used before? Arbitrum has now used it twice. A power used twice is a policy.
4. Separate chains from tokens. Freezable stablecoins (USDT, USDC) can be frozen by their issuers even on chains nobody controls. Holding USDT on Bitcoin does not give you Bitcoin's guarantees.
5. Keep long-term holdings in self-custody. A hardware wallet you control is still the only setup where nobody else's signature can move your funds. Our beginner guides explain the trade-offs.
6. Never keep your whole stack on one Layer 2. Spread across chains and custody types, so one council, one freeze, or one outage cannot lock everything at once.
7. Watch the governance forum, not just the price. Emergency actions are disclosed there first. If you hold ARB, the vote on the $30 million holding address is the next event that actually matters.

What Happens Next: 3 Scenarios for the $30 Million

Scenario 1 — DAO vote returns it (most likely, slowest). ArbitrumDAO votes to release the funds to Binance or to affected parties, coordinated with law enforcement. Timeline: weeks to months, given the legal wrangling after April.

Scenario 2 — Courts freeze the argument. Competing claims — victims, governments, terrorism-judgment creditors, as seen after the April recovery — tie the funds up while lawyers argue. The money stays put, and the precedent debate gets louder.

Scenario 3 — The power gets challenged or reformed. ARB holders, spooked by the "any address can spend" implication, push to raise the emergency threshold, add time-locks, or narrow the council's mandate. This is the scenario that would actually change crypto governance — and it only happens if users pay attention.

Our base case is Scenario 1 with elements of Scenario 2: the funds eventually move, but slowly, and the argument about what the council should be allowed to do next outlives the transfer itself.

FAQs

Did Arbitrum steal money from a user?

No. The council moved funds from an address linked to the Binance exploit, disclosed the action on its governance forum, and locked the money in a holding address that only a DAO vote can unlock. Whether that counts as justice or overreach is a governance debate — but it was not a secret theft.

Can the Arbitrum council move my funds?

Technically, the mechanism demonstrated on Friday could be applied to any address on Arbitrum: nine of twelve council members can authorize an emergency contract upgrade. In practice, the council has only used it against identified exploiters, under published rules, with public disclosure. The risk is real but narrow — and it is now proven, not theoretical.

Is my crypto safe on Arbitrum?

For everyday use, yes — the network is operating normally and no ordinary users were affected. For large, long-term holdings, weigh the trade-off: you gain speed and low fees, and you accept that a 9-of-12 council holds emergency power over the network. Self-custody on Bitcoin or a hardware wallet removes that third party entirely.

What happened to the rest of the $6.3 billion from Binance?

Only about $30 million — roughly 0.5% — was recovered through this action. The rest moved through other routes, and some was frozen by stablecoin issuers. Binance has said it will cover customer losses from its reserves, and withdrawals have been reopening in phases. Recovery of the full amount is not expected.

Has Arbitrum done this before?

Yes. In April 2026 the Security Council moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker. The Friday action is the second use of the power in 2026, which is why it matters as precedent rather than as a one-off.

Should I move my crypto off Arbitrum?

Not on this news alone, and not in a panic — hasty moves during volatile weeks are how people fall for phishing and fake "recovery" scams. But do use the checklist above: know who holds emergency power wherever your money sits, keep long-term holdings in self-custody, and never keep everything in one place. If you are unsure how wallets work, start with a beginner guide before moving anything.

Conclusion: The $30 Million Question Nobody Can Dodge Anymore

Arbitrum's council did something most crypto users believed was impossible: it moved $30 million without a private key, in public, under rules the network's own token holders approved. It did it to a thief, for sympathetic reasons, with disclosure and a governance lock on the proceeds. You can applaud the outcome and still be troubled by the mechanism — in fact, that is the only honest reaction.

Crypto's founding promise was that math, not committees, would guard your money. Friday's $30 million transfer proves that promise now comes with an asterisk on every upgradeable network: math guards your money, unless nine people with emergency powers decide otherwise. That asterisk was always there. Now it is on-chain, timestamped, and impossible to unsee. The question for every holder is no longer whether such powers exist. It is whether you have chosen, deliberately, to live under them — and what you will do with the money you have not.

Sources: CoinDesk and Traders Union reporting on the Security Council action, the council's governance-forum notice as reported, Zealynx's on-chain tracing, and FBI attribution of the Binance hack to TraderTraitor. Internal reading: our guides to best crypto wallets for beginners, what a crypto wallet really is, how to buy crypto safely, our Binance withdrawals explainer, and our FBI North Korea attribution report. External sources: Traders Union on the Security Council move and HokaNews on the $30 million transfer.