Arbitrum's Security Council used emergency powers to force roughly $30 million in stolen Binance assets out of an attacker's wallet, according to TRM Labs' investigation. Its account, covering activity through October 30, 2026, identifies 8,426 ETH and 74.6 million ARB removed through two forced transfers. The dollar figure reflects the investigation's valuation, rather than a fresh November 3 price.
The intervention bypassed the attacker's authorization through network governance without recovering the attacker's private key.
Two Forced Transfers Took Assets Out of Reach
TRM places the council's action at 00:08 UTC on October 30, following the October 29 Binance theft. Its investigators describe the transfers as moving the assets beyond the attacker's reach. Returning those funds to an exchange or its customers is a separate step; TRM's account does not establish completed customer repayment.
The assets also distinguish this operation from an issuer freezing its own token. TRM separately recorded stablecoin freezes by Tether, Circle, Ripple and World Liberty Financial. Arbitrum's action reached ETH and ARB through the network's emergency authority.
The council could therefore redirect these balances even with the wallet's signing key still in the attacker's possession.
Nine Approvals Can Bypass the Normal Waiting Period
Arbitrum's constitution gives its 12-member Security Council authority to execute emergency upgrades and other required actions without delay. Such action requires approval from nine members.
The constitution restricts that route to a security emergency. It also requires a subsequent transparency report explaining the action and its justification. The DAO can change or eliminate the council's powers through a constitutional proposal.
The signing threshold provides a check before execution, and the transparency report provides public accountability afterward. These checks operate without requiring the affected wallet holder's permission. Users depend on the council's signers to exercise their authority within the emergency mandate that allowed the stolen assets to be taken out of the attacker's control.
Controlling a private key governs ordinary wallet authorization; administrative powers remain embedded in the network carrying the assets. Assessing custody therefore requires examining both the wallet and the chain's governance.
Overview
Arbitrum's Security Council forced two transfers involving ETH and ARB valued at approximately $30 million in TRM's October 30 account. The council acted through network emergency powers, which require nine approvals under Arbitrum's constitution.
