Binance Hack Wallet Tried To Sell 10M ARB Before Rescue

A wallet Arbitrum linked to the Binance hack tried to sell 10 million Arbitrum (ARB) tokens, worth about $1.6 million at the time. The order asked for Ethereum (ETH) in return. It expired without the trade being completed.

The wallet held a much larger amount: 74.56 million ARB. The 10 million tokens offered for sale were only part of that holding. Arbitrum’s Security Council later moved all 74.56 million ARB to another wallet, taking them out of the original holder’s reach.

The order had expired more than two hours before Arbitrum intervened. The records do not explain why the trade failed to complete before its deadline.

The Wallet Was Trying To Exchange ARB For ETH

The order placed through Velora, a service for trading cryptocurrencies, offered 10 million ARB. It asked for a minimum of about 677.67 ETH in return. The ETH was meant to go back to the same wallet.

ARB is the token of the Arbitrum network, where these transfers took place. The order would have changed the assets held in the wallet, from ARB to ETH. The receiving address would have stayed the same.

The wallet had received 74,559,805.2 ARB at 21:36 UTC on 29th October. It then received 8,425 ETH at 21:38 UTC. Both transfers came from the same address.

At 21:41 UTC, a transaction approving the 10 million ARB order was recorded on the blockchain. There were about ten minutes left before the order’s deadline.

Approving The Trade Did Not Complete The Sale

Arbiscan, the website used to view these transfers, marks the approval transaction as successful. What succeeded was the permission to carry out the trade. The exchange of tokens still had to happen.

The transaction recorded two permissions. The first allowed Velora’s trading software, called a smart contract, to spend 10 million ARB from the wallet. The second approved this particular sell order.

For the sale to complete, those ARB tokens would then have had to leave the wallet. The records show no such movement before the rescue.

The lower entry contains a long reference labelled orderHash. That reference also appears in Velora’s public order record. The amounts, receiving wallet and deadline produce the same reference when checked using Velora’s published format. That connects the approval shown in the screenshot to the 10 million ARB sell order.

The Deadline Passed With The ARB Still In Place

Velora’s record marks the order as expired and lists no completed trade. The wallet’s token movements tell the same story.

Its ARB transfer records, from just before the approval through 04:23 UTC on 30th October, show a single outgoing transfer: the later recovery of 74,559,805.2 ARB. These records came from Arbitrum’s public data service. The finding concerns this wallet and this period.

TechFlow had already reported that the wallet had approved ARB for trading and that the tokens remained there. The specific Velora order shows the amount offered, the ETH sought in return and the deadline that passed before the rescue.

The sequence was:

Times are shown to the minute. The exact gap between the order’s deadline and the recovery transaction was two hours, 27 minutes and 20 seconds.

Arbitrum Moved The Funds Beyond The Original Holder’s Reach

The recovery transaction sent the ARB to an address ending in 0DA0. Arbitrum linked that address in a reply to its announcement.

The network said its Security Council had taken emergency action to secure approximately 74.56 million ARB and 8,425 ETH connected to the Binance exploit. In its statement, Arbitrum said the original holder could no longer access the assets.

The funds were placed in an interim frozen wallet. Moving them again would require another decision by the Security Council or a vote through Arbitrum’s community governance process. The announcement described that step in the recovery, without saying the assets had already been returned to Binance or its users.