Originally published at Arcus Perps Exploit: Subaccount Bug Drains $2.23M

On the evening of 9 November 2026 (about 03:07 UTC on 10 November ), a newly created account on Arcus Perps , a perpetuals and stock-token exchange on Robinhood Chain , found a bug in how the exchange handled transfers between a user's own subaccounts. Under specific conditions, those transfers made the account's recorded balance far larger than what it actually held. The account then asked to withdraw against that balance, and 2,234,391 USDG left the exchange on-chain before withdrawals were stopped.

It could have been much worse. A further $3 million of withdrawal requests was held back by the bridge's on-chain rate limit, never paid out, and later reversed.…