Arcus Exploit: How a Subaccount Bug Drained $2.23M and Why Users Lost Nothing

The hack spree continues. Over the past two weeks we covered the Binance hack post mortem , the Mercado Bitcoin hack and the StonkFun website attack . Now a perp DEX we list has taken a hit too. Short answer: The Arcus exploit hit Arcus Perps, a trading platform on Robinhood Chain, on the night of November 9. A newly created account abused a flaw in transfers between its own subaccounts. That bug inflated its recorded balance, and the attacker withdrew 2,234,391 USDG against it.