OnchainLens reported that Arcus lost $2.23 million USDG after a newly created account exploited a subaccount transfer bug to inflate its balance and withdraw funds, with a further $3 million attempt blocked by rate limits and the treasury covering the shortfall.