Arcus pays out 2,234,391 USDG after integer underflow exploit

CertiK traced nine BridgeVault payouts on Robinhood Chain to a balance bug, while a bridge rate limit held back roughly $3 million more

Arcus, a decentralized exchange running on Robinhood Chain, paid out 2,234,391 USDG to an exploiter after a bug let a freshly created account inflate its own balance.

Security firm CertiK attributes the incident to an integer underflow. That is the kind of math error where a number drops below zero and wraps around into an enormous positive value. Picture an odometer rolling backward past zero and landing on 999,999.

The payouts happened across nine separate BridgeVault transfers to a wallet Arcus has since made public. Damage could have been worse. An on-chain rate limit kicked in early and blocked an estimated $3 million in additional withdrawals.

How the exploit unfolded

The trouble started at roughly 10:07 p.m. ET on November 9, 2026. A newly created account abused flaws in how Arcus handled transfers between subaccounts, which let it pump up its balance well past what it had actually deposited.

The exchange’s own incident report carries the November 9 date. CertiK notes that the relevant ledger activity and on-chain executions landed on November 10 UTC. Late evening on the US East Coast is already the next day in UTC, so both dates describe the same night.