Decentralized trading platform Arcus suffered a $2.234 million theft due to an accounting vulnerability, which has now been fully recovered.

Decentralized trading platform Arcus disclosed that an accounting vulnerability was discovered on November 10th, allowing users to withdraw funds they were not entitled to. Arcus fixed the vulnerability and covered all gaps within an hour; user balances were unaffected, and trading and withdrawals continued normally. At 11:07 AM on November 10th, a newly created account exploited a vulnerability in the handling of transfers between user sub-accounts to record a balance far exceeding its actual holdings and request withdrawals. Approximately $2.234 million USDG was withdrawn before withdrawals were halted, and another $3 million in withdrawal requests were intercepted and revoked by the cross-chain bridge rate limit.