Community Investigation

Arcus after the deadline: tracing 1.52 million USDS into a savings vault

November 14, 2026

Arcus after the deadline. ChainBounty investigation cover with the Arcus logo.

Arcus reported that 2,234,391 USDG left the platform in nine payouts. It said it covered the shortfall from its treasury. A separate offer asked for funds to be sent to a recovery Safe by 01:00 UTC on November 13. Treasury coverage and a return from incident-linked addresses are different events.

BlockintAI traced the original payouts through Relay into 1,052.212689 ETH on Ethereum. Its November 11 snapshot identified three branches: ETH at the source, DAI in a second wallet and BTC in five outputs. Later receipts show that the first two branches changed. We followed 1.52 million USDS into a savings vault and verified that the resulting shares were still in the same wallet at the cutoff.

Arcus incident report · BlockintAI original trace and on-chain offer

Where the USDS went

USDS is a stablecoin. sUSDS is a share in a savings vault: the deposit puts USDS into the vault and mints shares to the specified recipient. The number of shares can differ from the amount of USDS deposited.

Figure 1. DAI converted to USDS and deposited for sUSDS in the same wallet.

Figure 1. Confirmed asset conversions on Ethereum. Amounts are rounded; arrows represent sequence, not scale.

The confirmed deposits total 1,518,875.328929503130518396 USDS. The four receipts show 1,360,785.892469438902378408 sUSDS minted to the same wallet. A balance read at Ethereum block 26,409,795 matches that total, and the share contract emitted no outgoing Transfer from the wallet between the first conversion and that block. Its USDS balance at the check was zero. The DAI, USDS and sUSDS figures describe successive forms of the traced assets; they are not separate losses.

Did the recovery Safe receive the funds?

The on-chain offer names a Safe, a smart contract wallet, and a deadline of November 13 at 01:00 UTC. A transaction sent to a Safe can call the contract without depositing funds. The Ethereum offer transaction sent zero ETH to the Safe at the top level.

Robinhood Chain internal ETH check. The latest internal transaction listed for the recovery Safe was before the deadline, at block 111,328,693. Its execution trace shows three outgoing transfers of 1 wei each. The Safe’s balance fell by exactly 3 wei across that block. No newer internal transfer appeared in the address index, and the Safe’s ETH balance was the same at 35 sampled blocks through November 14, 01:10:04 UTC. These checks did not verify a return. Robinhood Chain transaction.

Addresses and cutoff

The Ethereum balance cutoff was November 14, 01:00:47 UTC. Robinhood Chain was checked through November 14, 01:00:51 UTC. The strongest positive finding is that the savings shares remained in the traced wallet. The checks did not verify an incident-related return to the named Safe, and do not establish whether there was a settlement elsewhere.