Two such transactions moved the $ARB and the ether to a holding address ending in 0DA0, and the original Inbox code was restored in the same transaction, according to the council’s notice on the Arbitrum governance forum.
“No other user’s funds or applications were affected,” the notice said. The funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties.”
Security firm Zealynx traced the transactions and said the funds arrived on Arbitrum about 10 minutes after the Ethereum transaction as type 0x65 transactions with blank signature fields, and they used the exploiter address’s own transaction counter.
The council “used powers the DAO gave it and published both actions within an hour and a half,” the firm wrote, adding that the assumption an address only moves when its key signs holds “up to whoever controls the upgrade path.”
That’s a big caveat, however, for a network that markets itself as decentralized, and means that whoever controls the upgrade path can make any address on Arbitrum spend.
The council has done this before. In April it moved 30,766 $ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker.
Getting that ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave.
Leave a Reply