Arcus Labs said it drew on company reserves to cover 2,234,391 Global Dollar (USDG) withdrawn after a bookkeeping defect caused one subaccount to register more funds than it held.
The incident started at 10:07 p.m. ET Monday, Nov. 9 (03:07 UTC Tuesday, Nov. 10), according to Arcus. The company said the flaw concerned how transfers between subaccounts were recorded, and that only one account was involved. Other users’ balances, positions and orders were unaffected, Arcus said.
A separate request to withdraw about $3 million was stopped by cross-chain bridge limits and later canceled. Arcus said it halted withdrawals at 11:07 p.m. ET Monday, repaired the flaw about 30 minutes later and resumed withdrawals at 4:26 a.m. ET Tuesday, Nov. 10 (09:26 UTC).
Arcus said it is working with blockchain investigators to locate the tokens taken in the attack. It also said it would assist law enforcement if necessary.
