On 30 October 2026, Arbitrum’s Security Council froze 8,425 ETH and approximately 74.6 million ARB, reportedly worth around $30.5 million in total, held on Arbitrum One by an address linked to the Binance hack. The funds were transferred to an intermediate address, removing them from the original address’s control. The ability to intervene can provide an additional safeguard for financial institutions, while raising questions about autonomy for users who associate blockchain with full disintermediation. The case illustrates how assessing a network also involves weighing asset protection against control over funds.
Arbitrum and emergency powers
Arbitrum One is an Ethereum layer 2 network designed to process transactions at lower cost while using the main network for settlement and data availability. Transactions are processed on a separate infrastructure, with their results and data published on Ethereum. This architecture combines the main network’s security mechanisms with a governance system of its own, including the ability to upgrade essential components of the protocol. Understanding how it works therefore requires examining both how transactions are verified and who is authorized to modify the infrastructure that executes them.
Within Arbitrum’s architecture, the Security Council is a committee of twelve members elected by ArbitrumDAO, whose governance involves ARB token holders and their delegates. The DAO’s Constitution grants the Council powers to intervene immediately in security emergencies, subject to approval by at least nine members. This mechanism allows action without waiting for a standard governance proposal to complete, a process whose timescale would be difficult to reconcile with an ongoing attack. The approval threshold distributes authorization across several individuals, while the ability to intervene remains concentrated in an identifiable body.
How the stolen funds were frozen
According to estimates published by Binance on 30 October, the attack affected assets worth approximately $6.3 billion, of which around $3 billion had been frozen across multiple networks. The exchange also stated that it had earmarked more than $6.34 billion of its own funds to cover the losses and restore customer balances. This amount excludes the frozen assets, which remain subject to recovery efforts. The final net loss will therefore depend on how much can ultimately be recovered, while the funding announced by Binance is intended to protect customers regardless of the outcome of those efforts.
To move the assets on Arbitrum One, the Security Council temporarily upgraded an Ethereum contract that handles incoming messages to the layer 2 network. The change enabled two transactions to be generated on behalf of the address linked to the attack, transferring its funds without authorization from the party controlling them. Within the same operation, the contract was restored to its previous implementation. According to the official account, other users and applications were unaffected. The temporary nature of the change relates to the code used to execute the transfer, while the administrative authority that made the intervention possible remains part of the governance architecture.
The involvement of ETH distinguishes this case from the freezing of certain stablecoins, whose issuers can prevent transfers through functions built into the token contract. USDC contracts, for example, include an authorized role that can add addresses to a blocklist. On Arbitrum, the intervention used privileges over the network’s infrastructure to move both ETH and ARB. Control of private keys remains essential for ordinary transactions, while upgrade powers can affect access to funds in exceptional circumstances. Transaction execution without intermediaries can therefore coexist with powers of intervention entrusted to third parties.
From freezing funds to returning them
Transferring funds to an intermediate address removes them from the control of their previous holder, while leaving their eventual destination to be decided. The technical account published on Arbitrum’s forum refers to an ArbitrumDAO vote, to be coordinated with the relevant parties. The emergency intervention therefore preserves the assets pending further decisions, without ensuring their immediate return. Recovery by the exchange remains separate from the restoration of customer balances, which Binance has committed to financing from its own resources.
The distinction between immobilizing assets and determining their destination is also evident in the April 2026 precedent, when the Security Council froze approximately 30,766 ETH linked to the KelpDAO attack. A subsequent governance proposal requested that those assets be transferred to a coordinated recovery program intended to restore the backing of rsETH, the token involved in the incident. The proposal specified the recipients, the intended use of the funds and the procedures required for their release. The case shows how the stage following a freeze requires decisions on the distribution of recovered value, potentially involving several operators and the effects of the attack on connected services.
Protection of funds and user autonomy
For financial institutions, the ability to activate an intervention after a theft can make an infrastructure more compatible with the need to protect assets entrusted by customers. The existence of a body able to act creates a possibility of recovery that can complement preventive controls and financial resources available to absorb losses, without ensuring the same outcome in every incident. The value of this safeguard depends on the speed of the response and the conditions under which it can be activated. Assessing a network therefore also involves its ability to contain the consequences of fraud, alongside its capacity to prevent unauthorized access.
For users who associate blockchain with full disintermediation and censorship resistance, the same capacity to intervene places a limit on the autonomy they seek. The case shows that personal control of private keys can coexist with third-party powers over the movement of funds. Even an intervention intended to contain a theft therefore confirms the existence of an authority capable of overriding the normal operation of addresses. The financial benefit of recovery and its compatibility with the freedom users seek become separate considerations. A function valued by those who prioritize the possibility of remedying fraud may be less acceptable to those who place greater emphasis on exclusive control over their assets.
Assessing these powers requires, in both cases, transparency about the conditions governing their use and the responsibilities of those exercising them. Arbitrum’s Constitution requires the Security Council to publish a report explaining its actions and the reasons for invoking emergency powers; the DAO can modify or revoke those powers through the prescribed procedures. Transaction records allow the technical execution to be reconstructed, while examining the reasons for the intervention makes it possible to assess how the delegated authority was exercised. For network users, trust therefore also depends on the predictability with which these powers are applied.
Conclusions
The Arbitrum case illustrates how the possibility of recovering funds and the absence of third-party intervention powers reflect different priorities in the use of blockchain networks. For financial institutions, a mechanism capable of preserving assets after a theft can provide an additional safeguard and support adoption of the infrastructure, provided that responsibilities and procedures are clearly defined. For those seeking full autonomy, the same powers introduce a dependence on governance even when exercised for the benefit of victims. Assessing a network therefore also depends on the degree of control users wish to retain and the trust they are willing to place in those authorized to intervene.
