Decentralized trading platform Arcus hit by exploit, approximately $2.23 million extracted

Decentralized trading platform Arcus suffered an accounting vulnerability on November 10 that allowed a newly created account to inflate its balance via a flaw in the handling of transfers between user sub-accounts and withdraw roughly $2.234 million in USDG on-chain. Arcus Labs covered the shortfall in full from its corporate treasury, leaving user balances unaffected, and trading and withdrawals continue to operate normally. A further $3 million in withdrawal requests were blocked by cross-chain bridge limits and were never paid out, with those requests canceled. The team says it patched the vulnerability within an hour of detecting the anomaly and is working with on-chain investigators to trace the extracted funds. The incident highlights persistent smart-contract and accounting risk in DeFi even as user funds were made whole, and the focus now is on whether the traced USDG is recovered or returned.