Binance requests recovery of 8,426 ETH and 74.56 million ARB following hot wallet breach

Binance Requests Release of Frozen Assets

On November 5, Binance formally requested the Arbitrum Decentralized Autonomous Organization (DAO) to approve the release of nearly 8,426 ETH and around 74.56 million ARB tokens that were frozen following a breach of its hot wallet. This initiative kicks off a governance process anticipated to last at least seven weeks.

Proposal Submission and Governance Process

The proposal was submitted via Binance's official forum account, with the exchange appealing to token holders for permission to restore the assets currently held in a frozen state on Arbitrum One. The compromised funds are stored in a temporary locked address, and before any movement of the assets can occur, a series of actions including forum discussions, a Snapshot temperature check, and a binding on-chain vote is required.

In order to support users impacted by the exploit, Binance has pledged to utilize funds from its Secure Asset Fund for Users (SAFU) and its company reserves. Should the retrieval of these assets be successful, it may help address any financial repercussions from the incident, including restoring reserves that were previously drawn upon to reimburse customers.

Details of the Asset Freeze

The assets were frozen by Arbitrum’s Security Council on October 30 at 8:08 a.m. in Hong Kong, which aligns with the evening of the previous day in the United States. To enact this halt on the funds, the council performed a temporary upgrade to Arbitrum’s Inbox contract on Ethereum, allowing the movement of the compromised assets into a secured frozen address, before reinstating the original contract configuration.

"Notably, the council confirmed that no other users' funds or applications were compromised during this incident and clarified that any transfer of the frozen tokens could only be executed following a governance vote by the Arbitrum DAO."

Recovery Process and Timeline

If Binance's request is granted, a similar technical framework would be employed for the recovery. An approved proposal would necessitate a temporary alteration of the Inbox contract, enabling the migration of the frozen assets to a designated recovery account by Binance, followed by the retraction of the temporary adjustments.

Interestingly, the assets in question have been immobile on the network, and Binance does not foresee any significant expenses from the DAO's budget beyond the routine governance execution costs. The exchange estimates that the full process involving discussions, voting, and execution will take about 49 days, although it may extend further. This timeline outlines a week for forum conversation, followed by a week for the temperature check, and a two-week voting period.

Governance Rules and Legal Considerations

Arbitrum’s governing rules stipulate that a minimum of 1 million ARB must be delegated to submit an on-chain proposal. There is also a mandatory waiting period of three days prior to voting, which generally spans 14 days and could extend if quorum is late in being achieved. Approval requires a majority of votes in favor, with a participation threshold that factors in both support and abstentions.

Each successful proposal must also clear waiting periods on both the Arbitrum and Ethereum networks, with message finalizations requiring adherence to challenge periods. However, provisions have been made to halt any on-chain submission and transfer during ongoing legal proceedings unless a competent court permits the actions. Binance has also committed to maintaining the recovered assets in a separate location as long as any legal matters linger and to managing any competing claims at its own cost.

Prior to moving forward with the submission, Binance must enter into indemnification agreements binding the Arbitrum Foundation, Offchain Labs, and members of the Security Council, governed under New York law with any disputes settled within New York County courts. These terms tackle potential liabilities associated with both the initial asset freeze and forthcoming recovery attempts.

Update on Asset Withdrawals

In conjunction with the recovery request, Binance also issued its eighth update concerning asset withdrawals, set to recommence from 04:00 UTC on November 5. This update includes a selection of assets across various blockchains such as Ethereum, BSC, Base, Tron, Polygon, and Sui, with availability to be reintroduced progressively post-security evaluations.

While deposits have been enabled, Binance cautions users of possible delays in accessibility due to the high volume of transactions in the past week. In a separate announcement on the same day, Binance reported the deactivation of all API keys linked to the third-party provider SignalPlus following a reported security vulnerability, ensuring that Binance’s own infrastructure remains unaffected and user funds are secure.

Users of SignalPlus were advised to monitor their positions and orders directly through Binance while awaiting confirmation of the issue’s resolution before reconnecting their API keys and turning on IP whitelisting.