Last Friday, Arbitrum's Security Council moved about $30 million in crypto out of an address linked to the Binance hack. The council did not hold that wallet's key, and did not need it. It used emergency powers to briefly swap the code of one of the network's core contracts, move the funds, then restore the old code inside the same transaction. CoinDesk reported the move on Tuesday, November 3.
The haul was more than 8,425 ETH and 74 million ARB. Next to the roughly $6.3 billion stolen from Binance on October 29, that is small. What makes the move newsworthy is not the amount but the method: a network that markets itself as decentralised showed that a group elected by token holders can, in an emergency, move funds from an address whose key they do not hold.
Nine signatures and one contract swapped briefly
Arbitrum's Security Council has 12 members, elected by ARB token holders. Emergency action needs nine of them to agree. The council's shared Safe wallet, which needs nine signatures, sent one Ethereum transaction that temporarily replaced the code of the Inbox contract, the contract that carries messages from Ethereum into Arbitrum. The replacement code added a function called sendUnsignedTransactionOverride, which let Arbitrum treat the council's transactions as if they came from the exploiter's address. Two transactions then moved the ETH and ARB to a holding address ending in 0DA0, and the original Inbox code was restored in the same transaction.
Security firm Zealynx traced the trail: the funds arrived on Arbitrum about 10 minutes after the Ethereum transaction, as type 0x65 transactions with blank signature fields, using the exploiter address's own transaction counter. The council published both actions within about an hour and a half. Zealynx says the council used powers the DAO granted it, and disclosed them quickly. A TRM Labs account cited by SpendNode puts the action at 00:08 UTC on October 30, a day after the Binance theft.
The money has not gone back to anyone yet
The holding address is not the final destination. Under the council's notice on Arbitrum's governance forum, the moved funds can only move again through an ArbitrumDAO governance vote, coordinated with the relevant parties. The council also says no other user's funds or applications were affected. This is not the first time it has used this route: in April it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker. That April recovery, according to CoinDesk, ran into legal delays.
We see two ways to read this, and both have something behind them. Read as emergency recovery, the council used lawful powers, disclosed them fast, and touched only the attacker's address. Read as a warning, the message runs the other way: a wallet does not move simply because its key signed, it moves as far as whoever controls the upgrade path lets it. The FBI has attributed the Binance hack to TraderTraitor, a North Korea-linked group. Where the $30 million ends up is still unanswered: it waits on a DAO vote. The Binance reserves proof users can verify themselves is in our zk proof article. Customer outflows since withdrawals reopened are in our outflows article.
Sources: CoinDesk (Nov 3, 2026), TradersUnion (Nov 3, 2026), SpendNode citing TRM Labs (Nov 3, 2026). Figures and status are snapshots at writing time, early November 4, 2026 WIB, and can change.
Written by Mastechon
Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.
Binance's SAFU wallet now holds 7,500 BTC, about $580 million, after four October 31 transactions halved its balance. A refill is pledged, with no date.
ZachXBT flagged a suspected $106 million theft from an EU entity's accounts at exchanges. The funds left as stablecoins, then were swapped into ETH and Monero.
Chainalysis estimates $49 million stolen from Mercado Bitcoin across 17 chains, with nearly $10 million frozen. The exchange itself puts $38 million involved.
From November 3, Anthropic adds an invisible watermark to 4 older Claude models. It changes nothing you read, but two models carry it only at default settings.
Binance finished the zero-knowledge proof for its October 31 snapshot: 10 tokens are now user-verifiable at 1:1. What changed, and what it does not cover.
Brazil's exchange halted withdrawals after a November 2 security incident. Researchers flagged over $40M in suspicious transfers, unconfirmed by the exchange.
Meituan released LongCat-2.5 on November 2: a multimodal model for long coding work, scoring 88.4 on Terminal Bench. Its parameter count is still disputed.
US spot Bitcoin ETFs lost $643.3 million net on Friday, October 30, their largest since June 25. Ether funds lost $155.9 million, yet Bitcoin rose to $78,491.
Apple and Alibaba announced October 31: Qwen will power Apple Intelligence in China. Developer beta starts November 4; public release with iOS 27.3 in December.
Binance reopened withdrawals in phases on November 1; the first 9.5 hours saw a net outflow of $3.64 billion, 2.1% of reported assets. Flows are stabilizing.
A page-speed script from DebugBear on Polymarket's site was replaced with malicious code on October 29. It used signed-in traders' sessions to move positions, hit 726 wallets, and Polymarket refunded $3.9 million.
DeepSeek released its open-source Super-agent prototype on October 31: a coding agent that watches team chat and proposes fixes without being called. What shipped, its limits, and safe pilot conditions.
Google's prototype satellite answered its first prompt from orbit with a haiku from the Gemma 4 model. What it proves, its limits, and the twin-satellite plan for 2027.
Binance opened phase one withdrawals November 1 and says 95% of the $6.3B stolen is replaced. What changed since the midday schedule, and what is still pending.
Binance has set phase one of its withdrawal reopening for today, November 1, 06:00-09:00 UTC across 15 networks. Here is the schedule, Binance's own warning, and what is still unproven.
The FBI says North Korea was behind the October 29 theft from Binance and asks crypto firms to block hundreds of linked addresses, as most of the stolen funds are converted into ether.
Bitcoin staking platform b14g paused affected contracts after unauthorized withdrawals on October 31; about 68 million CORE is still traceable on the Core network and 9 million was frozen by exchanges, while staked BTC was unaffected.
ICE and Trade[XYZ] agreed to build a regulated perpetuals venue on Hyperliquid, HYPE jumped to near $90, but nobody has said whether fees from the US venue flow back to HYPE holders.
Two days after the $6.3 billion hack, Binance says 10 major assets are fully backed, the remaining 10% is still being sourced because those tokens are less liquid, and full reserve proof is due November 3.
Mistral opens a 1-trillion-parameter model to everyone, Google locks down its top-ranked model, Bitcoin steadies after the Binance hack, plus a free VPS and free Super Intelligence video that are still live.
A cross-checked roundup of what X is talking about: the largest hack in crypto history at Binance, Bitcoin's market reaction, trending coins, and this week's open airdrop claim windows.
What a crypto airdrop is, why projects give away free tokens, the requirements they usually ask for, and the realistic outcomes to know before you start.
Testnets use fake money, but your accounts and wallet are real. How to join testnets safely: a dedicated wallet, official faucets, and verification habits.
