The hacker’s wallet had already received its share of the Binance heist.
More than 74 million ARB tokens and thousands of ETH were sitting on Arbitrum One, part of the $6.3 billion stolen from the world’s largest crypto exchange on October 29.
By the following morning, the money was gone.
The blockchain showed the wallet sending its holdings to another address. The transactions succeeded, the balances changed, and the tokens landed exactly where their new handlers wanted them.
There was just one problem.
The hacker never signed those transactions.
The private key hadn’t been stolen. Nobody had recovered the seed phrase, either. And whoever controlled the wallet certainly hadn’t agreed to hand over the money.
Instead, Arbitrum’s Security Council temporarily changed how part of the network processed messages, created transactions that appeared to originate from the hacker’s wallet, and moved an estimated $30.5 million into a holding address.
Then it restored the original system.
The entire intervention took place through a single Ethereum transaction, with the resulting transfers executed on Arbitrum roughly ten minutes later.
It was an effective response to an extraordinary theft.
It also exposed something that tends to disappear beneath crypto’s familiar promise of self-custody: holding a private key does not necessarily mean holding the final authority over how every blockchain processes your assets.
And the Binance incident wasn’t the first time Arbitrum had demonstrated that distinction.
The Wallet That Sent Money Without Signing
The Binance attack began on October 29, when unauthorized withdrawals drained about $6.3 billion from the exchange’s hot wallets.
In its official security incident update, Binance acknowledged the scale of the losses and said it was working with law enforcement, blockchain investigators, and token issuers to restrict the stolen assets.
On October 31, the FBI attributed the attack to TraderTraitor, a North Korean cyber operation that investigators said was already converting stolen assets into ETH and preparing further laundering activity.
But one particular wallet on Arbitrum tells a different part of the story.
The address, 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5, held 74,559,805.2 ARB and 8,425.998 ETH connected to the exploit.
At 00:18:20 UTC on October 30, its assets moved.
The ARB transaction on Arbiscan identifies the exploiter’s wallet as the sender. It shows 74.56 million tokens moving to 0x0000000000000000000000000000000000000DA0.
The transaction used nonce 2, succeeded, and produced a standard ERC-20 Transfer event.
That looks like a straightforward token movement.
Until you examine the transaction type.
Arbiscan identifies it as ArbitrumUnsignedTxType, type 101, or 0x65 in hexadecimal.
The separate ETH transaction followed the same mechanism, using nonce 3 to move the wallet’s ETH into the same holding address.
These weren’t conventional transactions signed by the wallet’s private key.
They were generated through Arbitrum’s cross-chain messaging infrastructure.
That distinction matters because a wallet address normally serves as the visible identity of whoever authorized a transaction.
Here, the visible sender and the authority that caused the transfer were different.
The explanation lies one layer deeper.
The Upgrade That Disappeared After Doing Its Job
Arbitrum’s October 30 Security Council disclosure describes an unusual sequence.
The council temporarily upgraded the Inbox contract on Ethereum, the component responsible for delivering messages into Arbitrum.
The replacement implementation introduced a function named sendUnsignedTransactionOverride.
Its purpose was remarkably specific: allow a cross-chain transaction to identify another address as its sender.
The council used that capability twice, once for ARB and once for ETH.
Then the original Inbox implementation was restored.
The underlying Ethereum transaction, executed at roughly 00:08 UTC, contains the temporary upgrade, message delivery, and restoration.
Because those operations occurred atomically, the contract returned to its original implementation within the same transaction.
Anyone comparing only the contract’s implementation before and after the Ethereum block would see the same code.
The intervention happened in between.
That detail caught the attention of security researcher Zealynx, whose November 2 technical examination traced the council’s message through Arbitrum’s transaction-processing system.
The researcher found that the forced transactions contained zeroed signature fields. Yet Arbitrum still accepted them as transactions originating from the targeted wallet.
There was no need to defeat cryptography.
The protocol’s authorized upgrade mechanism supplied a different route.
Even the ARB token contract saw an ordinary transfer. Its event log did not explain that the transaction originated from an emergency governance intervention rather than the wallet holder.
For a blockchain analytics system that treats every outgoing transfer as an action chosen by the address owner, that creates a subtle attribution problem.
The money genuinely moved.
The address genuinely appeared as the sender.
But the apparent sender did not authorize the transaction through its private key.
This does not mean an arbitrary outsider can imitate anyone’s wallet. The intervention depended on privileged governance access to Arbitrum’s infrastructure.
Still, it demonstrates that transaction history and transaction authorization are not always the same thing.
The blockchain recorded what happened.
Understanding who made it happen required digging considerably deeper.
Nine Signatures, One Emergency, and No Exit Window
So who authorized it?
Arbitrum has a 12-member Security Council, elected through its governance process and empowered to respond to emergencies.
Under the ArbitrumDAO Constitution, nine council members can approve an emergency action, including a software upgrade, without the delays normally imposed on governance proposals.
Those powers are documented, not hidden.
The constitution also restricts their use to genuine security emergencies and requires subsequent transparency reporting.
That gives the council a potentially valuable tool when an exploit threatens the network or its ecosystem.
It also creates a hierarchy of authority.
Ordinary wallet holders authorize their transactions with their private keys. Meanwhile, the Security Council can, when exercising its emergency powers, alter infrastructure that determines how certain transactions are accepted.
Those are different forms of control.
And when they collide, the protocol’s governance machinery can change the outcome.
Consider the timing.
Arbitrum’s constitution says an ordinary Constitutional Arbitrum Improvement Proposal typically requires at least 42 days from its initial temperature check to execution.
The Binance intervention delivered its two forced transactions to Arbitrum roughly ten minutes after the Ethereum execution.
These are not equivalent procedures, and the comparison should not be mistaken for a measure of normal transaction speed. But it illustrates why emergency authority is consequential: decisions that would normally face weeks of governance can take effect almost immediately.
There is another important detail.
L2BEAT’s assessment of Arbitrum One identifies it as a Stage 1 rollup and notes that the emergency upgrade mechanism provides no advance exit window.
In other words, users cannot rely on receiving a warning period before that particular kind of upgrade takes effect.
For someone watching the Binance theft unfold, that speed may look like precisely what the industry needed.
The hacker was trying to escape with billions. A network found a way to secure a small part of it.
Waiting six weeks for a governance vote would hardly have improved the situation.
But that argument answers only why emergency powers can be useful.
It doesn’t settle how broadly they should be exercised, or what protections remain when the emergency decision itself is disputed.
And Arbitrum had already encountered a version of that problem months earlier.
The Same Holding Address Had Already Entered a Courtroom
On April 21, 2026, Arbitrum’s Security Council took emergency action following the KelpDAO exploit.
The council announced that it had moved 30,765.67 ETH into a frozen holding address using the same temporary Inbox-upgrade approach.
The address was familiar:
0x0000000000000000000000000000000000000DA0
This was the very same destination that was later used for the Binance-related assets.
That connection is important, but not because it suggests the two thefts were part of the same on-chain transaction or recovery process.
It shows that Arbitrum had already established a mechanism for relocating assets associated with an exploit into governance-controlled custody.
In April, the immediate problem was securing the ETH.
The harder problem came afterward.
Aave Labs, KelpDAO, LayerZero, EtherFi, and Compound subsequently supported a proposal to release the frozen ETH into a recovery effort for affected rsETH holders.
Then an unexpected legal obstacle appeared.
Plaintiffs holding judgments against North Korea served ArbitrumDAO with a restraining notice concerning the immobilized assets.
The dispute complicated a recovery process that had initially looked like a technical success.
On May 8, US District Judge Margaret Garnett issued a court order allowing an on-chain governance vote to transfer the immobilized ETH to a wallet controlled by Aave LLC.
But the court did not simply declare the assets free for distribution.
The restraining notice would continue to apply after the transfer, and the court expressly reserved its decision on the remaining issues.
The amended Arbitrum governance proposal subsequently reflected that limitation. Aave LLC could receive the ETH under the approved process but could not freely use or distribute it while the legal restrictions remained in force.
The distinction is easy to miss.
Arbitrum had the technical ability to move the money.
Its DAO had a procedure for deciding where the money should go.
But the legal question of what should happen to the assets proved considerably less straightforward.
There is no evidence that the Binance-related funds are subject to the same legal claims. The May court order concerned the earlier KelpDAO assets, even though both interventions used the same holding address.
Nevertheless, the precedent reveals what happens after an emergency freeze succeeds.
A blockchain can establish where stolen assets are held.
It cannot, by itself, determine every competing legal claim over them.
Once the money stops moving, the dispute over who gets to move it next can become an entirely different story.
The $30 Million Was Never the Biggest Number
The scale of Arbitrum’s intervention deserves some perspective.
The estimated $30.5 million secured through its emergency action represents just 0.48% of Binance’s reported $6.3 billion loss.
That calculation uses the reported dollar values of the intervention and the overall theft, rather than treating the recovered token quantities as fixed-dollar assets.
It is a small fraction of an enormous incident.
Meanwhile, Binance said in its November 2 recovery update that it had replenished about 95% of the affected assets using company resources, with its ten listed major token balances backed at least 1:1.
That is encouraging for customers, but it is a different financial operation from recovering stolen assets.
Replacing missing tokens with corporate funds restores reserves. Freezing stolen tokens restricts what the holders can do with them. Returning those tokens to their rightful recipients is another process altogether.
Ravel previously examined that distinction in its report on Binance’s multibillion-dollar asset freezes.
The Arbitrum case raises a separate question.
Who has the ultimate authority to initiate a transfer on a network that advertises self-custody?
The answer cannot simply be that every token holder has an equal right to move assets without external interference.
In Arbitrum’s case, privileged emergency governance has powers that ordinary users do not.
That does not make the Binance intervention malicious.
The council disclosed its actions, identified the affected address as connected to the exploit, and stated that no other users’ funds or applications were affected.
There is a substantial security argument for the intervention.
Indeed, without a rapid response, more stolen assets might have left the network before investigators and ecosystem participants could act.
But the successful rescue should not obscure the system’s trust assumptions.
Users are relying not only on their own keys and the execution of smart contracts but also on the judgment, governance procedures, and security of those authorized to alter the protocol.
That is a different promise from unconditional control.
And it is one that deserves understanding before an emergency tests it.
What Does Your Private Key Actually Guarantee?
The Binance hacker lost control of tens of millions of dollars on Arbitrum without surrendering the private key to the wallet holding them.
For victims of the theft, that was probably a welcome outcome.
Developers, meanwhile, have a reason to think twice before treating a wallet’s transaction history as proof of its owner’s intentions.
Ordinary users face a more uncomfortable question.
This was not an intervention on Ethereum’s base-layer balances. It was an exercise of Arbitrum One’s documented emergency upgrade powers, using a cross-chain messaging path that the council could temporarily modify.
Nor does it establish that the Security Council has acted improperly. The available record describes an intervention against assets associated with a major exploit, not an unexplained seizure of ordinary customer funds.
The important finding is narrower and more revealing.
Arbitrum’s governance design allows an authorized group to change the rules through which some wallet transactions are processed. In this case, that authority was sufficient to move assets without the apparent sender’s cryptographic consent.
The same mechanism that protected stolen funds also demonstrated a limit to the wallet holder’s independence.
Perhaps that is a reasonable compromise for a network handling billions of dollars.
Perhaps stronger safeguards will eventually be needed.
The evidence does not settle that debate.
It does establish that private keys and protocol-level authority are different things.
On October 30, Arbitrum showed what happens when the latter overrides the need for the former.
The hacker’s wallet still had a private key.
It just wasn’t the key that decided where the money went.
