ChainCatcher reported on November 11, 2026, at 08:00:56 (UTC+8), that the decentralized trading platform Arcus had disclosed an accounting flaw found on November 10, Beijing time.
The flaw allowed a user to withdraw funds that the user was not entitled to receive. Arcus said it detected and fixed the flaw within one hour and covered the full shortfall. It also said user balances were not affected and that trading and withdrawals were proceeding normally.
The report gives this sequence. At 11:07 Beijing time on November 10, a newly created account used a flaw in how the exchange handles transfers between user sub-accounts. That account recorded a balance far higher than the assets it actually held and requested a withdrawal. The notice does not state the exact recorded balance.
Before withdrawals were stopped, about $2.234 million in USDG had already been withdrawn on-chain. A separate $3 million withdrawal request was intercepted by a rate limit on the cross-chain bridge, was not paid, and was later revoked. The source does not name the chains, describe any lock, burn, or mint, or say that the bridge released the $3 million.
The handoff in the notice is therefore an internal ledger step, not a bridge settlement. The overstated balance was recorded in Arcus’s sub-account transfer accounting. One sum then left as an on-chain USDG withdrawal. The other request is described only as having been stopped by the bridge rate limit and revoked. That rate limit is a stated control on one request; the report does not present the bridge as trustless or as the source of the accounting error.
Arcus Labs said it covered the entire shortfall from the company treasury. It is working with blockchain investigators to trace the funds, has published the attacker’s initial address, and has asked exchanges and service providers to flag related funds. The ChainCatcher notice does not include that address.
Original report: ChainCatcher, published November 11, 2026, at 08:00:56 (UTC+8).
