Arbitrum (ARB): how the Ethereum layer 2 works, its token, its Security Council and the 2026 changes

Arbitrum is the best-known layer 2 network on Ethereum, and in 2026 it is also a licence: other companies now run chains of their own on Arbitrum code. Robinhood Chain, live since 1 July 2026, is the largest of them by DefiLlama’s count. On Arbitrum One, the home chain, DeFi apps held about $1.44 billion on 24 October 2026, according to DefiLlama, about a third of the October 2025 peak.

Two other changes marked the year. The Security Council, a 12-member multisig that can upgrade the system without waiting for a vote, used its emergency powers three times between April and October. And on 23 September, Priority Gas Auctions replaced the Timeboost auction as the way transactions are ordered on Arbitrum One.

Figures on this page carry their date. The ARB price is shown live on Coindaro and is not part of the text, which is not investment advice.

What is Arbitrum? An optimistic rollup that settles on Ethereum

Arbitrum One is an optimistic rollup. It executes transactions away from Ethereum, then posts the data and a claim about the result to Ethereum. The claim stands unless someone proves it wrong during a challenge window. That assumption is the “optimistic” part, and it is why moving funds back to Ethereum by the standard route takes about a week.

Gas on Arbitrum One is paid in ETH, not ARB. The ARB token is a vote in the Arbitrum DAO, which governs the protocol, its treasury and the Security Council elections. Holding it gives no claim on fees.

“Rollups give you the security derived from Ethereum but a much better experience in terms of costs,” Steven Goldfeder, co-founder and chief executive of Offchain Labs, told TechCrunch in August 2021. Five years on, Arbitrum ranked 8th among all chains by DeFi TVL on DefiLlama on 24 October 2026, behind Ethereum, Base, Solana, BSC, Tron, Bitcoin and Hyperliquid L1.

How Arbitrum works: sequencer, batches and fraud proofs

The Arbitrum documentation describes three moving parts: a sequencer that orders transactions, nodes that execute them the same way every time, and Ethereum, which confirms the results through a dispute protocol.

One sequencer, run by Offchain Labs

On Arbitrum One and Nova, a single sequencer operated by Offchain Labs puts transactions in order and publishes them in a real-time feed, which gives users a “soft” confirmation in well under a second. Arbitrum One produces a block every 250 milliseconds.

One operator means it could, in principle, refuse a transaction. L2BEAT, the research site that grades rollups, says the sequencer gives no real-time protection against censorship. The fallback is slow: a user can send a transaction through Ethereum’s delayed inbox and force its inclusion after at most 24 hours.

Since 23 September 2026, the order inside each block is set by Priority Gas Auctions (PGA). Each 250-millisecond block holds two rounds of 125 milliseconds, and within a round the transactions paying the highest priority fee go first. Transactions that pay nothing extra move up the queue the longer they wait. A paid Fast Feed streams each transaction to subscribers as soon as it is ordered, without letting them change the order.

Batches posted to Ethereum

The sequencer compresses transactions into batches and posts them to Ethereum, “perhaps every few minutes in production” according to the docs. Since the ArbOS 20 “Atlas” upgrade of March 2024, it can use the blob space created by Ethereum’s EIP-4844 when blobs are cheaper, and ordinary calldata otherwise. With the full data on Ethereum, anyone can rebuild Arbitrum One’s state. Arbitrum Nova works differently: it hands its data to a committee (the “AnyTrust” model), which costs less and asks users to trust that at least two committee members are honest.

BoLD fraud proofs and the week-long withdrawal through the Arbitrum bridge

Validators post assertions about the state of the chain and lock a bond in WETH to do so. An unchallenged assertion is confirmed when the challenge period ends. A challenged one is split in halves again and again until a single instruction is left, which Ethereum checks itself. The losing side forfeits its bond.

This system, BoLD, went live on Arbitrum One and Nova in February 2025 and replaced an allow-list of approved validators, The Block reported on 12 February 2025. Validation is now open to anyone. In the words of the docs, “any one honest validator can force the correct execution of the chain to be confirmed”.

The price is time. The docs give a challenge period of 6.4 days; L2BEAT lists 6 days and 8 hours plus a 2-day execution delay. A withdrawal through the native bridge therefore takes about a week. Third-party bridges and liquidity providers pay out faster, for a fee and with risks of their own.

Nitro, ArbOS and Stylus

The software behind all of this is Nitro, live on Arbitrum One since 31 August 2022. It wraps the core of Geth, the main Ethereum client, inside ArbOS, the layer that handles Arbitrum’s own fees and bridging. The same Go code is compiled twice: natively, to run fast, and to WebAssembly, so that a disputed step can be proven on Ethereum.

Upgrades ship as numbered ArbOS releases. ArbOS 40 brought EIP-7702 support on 18 June 2025, according to L2BEAT’s log. Elara, active on Arbitrum One and Nova since 20 August 2026 (ArbOS 61 in the docs, ArbOS 60 on the blog), gave owners of dedicated chains optional compliance filters and priority fees, prepared Arbitrum One for priority ordering, let Offchain Labs adjust the minimum base fee for two years within DAO limits of 0.01 to 0.10 gwei, and raised the size limit of Stylus contracts from 24 KB to 96 KB.

Stylus is a second virtual machine that runs WebAssembly next to the EVM, so developers can write contracts in Rust, C or C++ that call Solidity contracts and the reverse. It opened on a public testnet on 31 August 2023 and reached Arbitrum One and Nova with the ArbOS 31 “Bianca” upgrade at the end of the summer of 2024. The Arbitrum blog claimed compute “over 10x improved” and memory “over 100x improved” against Solidity, without published benchmarks. New Stylus activations have been frozen since 2 October 2026 (dated section below).

Arbitrum One, Nova and Orbit chains (now the Arbitrum Platform)

The DAO governs two public chains, and Offchain Labs licenses the technology to others. Arbitrum One, the general-purpose rollup, is the chain most people mean by Arbitrum.

Nova, the cheaper AnyTrust chain launched in 2022, is being run down. The DAO voted to “minimize” it: projects had a 90-day migration window from 4 June to 2 September 2026, after which Nova moved to maintenance-only support, slower answers and tighter limits on public RPC endpoints, according to the Foundation’s FAQ on the plan. Users can still move funds out.

The third group is dedicated chains built with the Arbitrum Platform, the toolkit long known as Orbit. A company runs its own chain on Arbitrum code and chooses its settings, gas token included. In July 2024 the Foundation proposed opening the licence to chains that settle outside Ethereum, and early Snapshot results showed over 99% support, The Block reported. More than 30 Arbitrum chains “are already contributing” to the Developer Guild, according to the Guild’s launch post of 23 October 2026. The number of live chains is not published in the sources checked.

Those chains pay for the licence under the Arbitrum Expansion Program (AEP): 10% of their net protocol revenue, of which 8% goes to the DAO treasury and 2% to the Developer Guild, the DAO’s factsheet on Robinhood Chain says. Robinhood listed its first stock tokens on Arbitrum One in June 2025, opened a public testnet of Robinhood Chain on 10 February 2026 and launched the mainnet on 1 July 2026, with ETH for gas and settlement on Ethereum. DefiLlama counts it apart: on 24 October 2026 Robinhood Chain held about $1.13 billion in TVL, 9th among chains, one place behind Arbitrum One.

So the platform brings licence fees to the DAO, while activity that might once have landed on Arbitrum One now shows up under other chains’ names.

Arbitrum in numbers as of 24 October 2026

The figures below come from DefiLlama, L2BEAT and the Arbitrum Foundation, and they measure different things. DefiLlama’s TVL counts assets deposited in DeFi apps. L2BEAT’s Total Value Secured counts every asset held on the chain, bridged or minted there, which is why it is far larger.

Measure	Value	Source and date
DeFi TVL on Arbitrum One	about $1.44 billion (8th among chains)	DefiLlama, 24 Oct 2026
Peak DeFi TVL	about $4.20 billion	DefiLlama, 7 Oct 2025
Total Value Secured	$10.04 billion, of which $4.27 billion in stablecoins	L2BEAT, 24 Oct 2026
Dollar stablecoins on the chain	about $3.73 billion	DefiLlama, 24 Oct 2026
DEX volume, last 30 days	about $4.93 billion	DefiLlama, 24 Oct 2026
Gas fees paid by users, last 30 days	about $0.69 million	DefiLlama, 24 Oct 2026
Gas fees paid by users, last 12 months	about $7.9 million	DefiLlama, 24 Oct 2026
Transactions in the first half of 2026	478 million (2.7 billion since launch)	Arbitrum Foundation, 2 Sep 2026
ArbitrumDAO income, first half of 2026	$6.19 million	Arbitrum Foundation, 2 Sep 2026

The largest DeFi apps on the chain by TVL on 24 October were Aave V3 (about $524 million), the Hyperliquid bridge ($392 million), Spark Savings ($310 million), USD AI ($262 million) and GMX ($199 million), per DefiLlama. TVL is counted in dollars, so part of the fall from the 2025 peak reflects lower token prices rather than money leaving.

History of Arbitrum, from Princeton research to Robinhood Chain

Offchain Labs was founded in 2018 by Steven Goldfeder, Ed Felten and Harry Kalodner. The technology was first developed at Princeton University, which licensed it to the founders, TechCrunch reported in 2021. About 350 teams signed up for the developer beta of Arbitrum One in May 2021, and the mainnet opened to the public on 31 August 2021, the day Offchain Labs announced its $100 million Series B.

The early years had outages. On 14 September 2021 the sequencer stalled for about 45 minutes after a burst of transactions; Offchain Labs said funds were never at risk, Decrypt reported. On 7 June 2023 a bug made the sequencer’s batch postings to Ethereum fail, The Block reported. On 15 December 2023 a surge of inscription transactions stopped the sequencer for about an hour and a half, according to The Block.

The ARB token arrived on 16 March 2023, and airdrop claims ran from 23 March to 24 September 2023. Within days the first governance proposal, AIP-1, caused an uproar. It presented as a “ratification” a plan to give the Foundation 750 million ARB, then worth about $1 billion, and holders “voted overwhelmingly against” it, The Block reported on 3 April 2023. The package was split into AIP-1.1 and AIP-1.2, and the Foundation’s 7.5% now vests over four years.

Then came blob support in March 2024, Stylus in 2024, permissionless BoLD validation in February 2025 and the Timeboost ordering auction on 17 April 2025. The business side followed: Robinhood’s stock tokens in June 2025, Robinhood Chain on 1 July 2026, and on 20 August 2026 the Elara upgrade and a plan for ZK settlement.

ARB tokenomics and the unlock schedule

The supply was set at 10 billion ARB at launch. The Foundation’s token docs allow inflation of at most 2% a year; Tokenomist still showed a total of exactly 10 billion on 24 October 2026. The allocation after AIP-1.1 and AIP-1.2, per the Foundation’s docs:

Holder	Share	ARB	Release
ArbitrumDAO treasury	35.28%	3.528 billion	Spent by DAO vote
Team, contributors and advisors	26.94%	2.694 billion	One-year lock, then monthly from 16 Mar 2024 to 16 Mar 2027
Investors	17.53%	1.753 billion	Same schedule as the team
Airdrop to users	11.62%	1.162 billion	Claims from 23 Mar to 24 Sep 2023
Arbitrum Foundation	7.5%	750 million	Linear over four years from 17 Apr 2023
DAOs of the ecosystem	1.13%	113 million	Airdropped in 2023

How many ARB circulate depends on who counts. Tokenomist gave 6,892,115,031 ARB, 68.92% of the total, at 18:08 UTC on 24 October 2026. The Foundation said on 2 September that about 9.23 billion ARB (92.3%) were “unlocked or held in the DAO treasury” on 17 August, with 0.77 billion still vesting. The two figures use different definitions: the Foundation adds the treasury’s tokens to the unlocked ones, while Tokenomist groups the treasury with the Foundation in one allocation (42.78%) that it does not fully count as circulating.

Tokenomist lists the next unlock on 16 November 2026, going to the DAO treasury. The last team and investor tranche, about 92.65 million ARB, is due on 16 March 2027 and ends the four-year vesting; we cover it on our page about the final ARB unlock of March 2027.

How Arbitrum makes money, and who gets it

The DAO earns in four ways, according to the Foundation’s report on the first half of 2026: transaction fees on Arbitrum One, ordering revenue (Timeboost until September), AEP licence fees from dedicated chains and income on treasury assets. Together they brought the ArbitrumDAO $6.19 million in the first six months of 2026, with a gross margin above 97%. In July alone AEP fees reached $360,000, 35% of the DAO’s income that month. The treasury held $125 million in assets other than ARB on 30 June. None of this money goes to ARB holders.

Timeboost, the auction for a short head start in the queue, went live on 17 April 2025 and had earned about $7.46 million in fees by mid-June 2026, according to figures the delegate Entropy posted on 16 June in the thread of the proposal that replaced it. Entropy found that Timeboost captured 1.74% of atomic arbitrage revenue on Arbitrum, against 28.83% on Ethereum through MEV-Boost and 7.34% on Base. About 87% of atomic arbitrage and 98% of liquidations bypassed it, and three entities won about 97% of the auctions.

Priority Gas Auctions were proposed by Offchain Labs on 3 June 2026, with 97% of priority fees going to the DAO treasury and 3% to the Developer Guild. The switch took effect on Arbitrum One on 23 September, according to the ArbOS 61 notice in the docs and L2BEAT’s log; the Arbitrum blog published its guide to bidding for priority the next day.

Arbitrum DAO governance: the constitution, the Foundation and the new voting interface

Changes to Arbitrum go through proposals called AIPs, under the DAO constitution. A constitutional AIP, the kind that touches the core software or the constitution itself, needs a quorum of 50% of delegated votable tokens, with a floor of 150 million and a cap of 450 million ARB. An ordinary AIP needs 40%. Votes last 14 days. Tokens held by the Foundation and unclaimed airdrop tokens cannot vote.

Waiting periods follow the vote: three days on Arbitrum for treasury actions or eight for messages to Ethereum, a full rollup challenge period, then three more days on Ethereum. From the start of a temperature check, a constitutional AIP takes at least 42 days and an ordinary one at least 27. Posting a temperature check takes 500,000 ARB of voting power; submitting an AIP on chain takes 1 million delegated ARB.

The interface changed in 2026. Tally, the third-party site where Arbitrum votes used to run, wound down, and on 28 April the Foundation announced in a forum post on its governance interface that votes would move to its own site, Arbitrum Governance, built with Offchain Labs, with Snapshot as a backup. Voting and Security Council elections came first; delegation and proposal creation were in place by 18 June 2026.

The Foundation and the Developer Guild

The Arbitrum Foundation runs day-to-day operations for the DAO. On 22 May 2026 it asked for one more year of funding: $16 million in tokenised assets and stablecoins, 1,740 ETH and 230 million ARB, about $45 million according to The Defiant, against projected 2027 operating costs of $27.6 million. Delegates asked for milestone-based releases, KPIs and clawbacks of unused funds. The forum thread and the Foundation’s reports checked for this page do not give the result of the on-chain vote.

The Developer Guild, launched in a forum post on 23 October 2026, is an invite-only, merit-based programme facilitated by the Foundation. It is funded by 2% of net protocol revenue from Arbitrum chains and 3% of PGA and Fast Feed proceeds. Its first and only member is Offchain Labs, which receives the Guild’s current funds and all its future revenue for as long as it remains the sole member. Offchain Labs also writes the code, runs the sequencer and posted the PGA, Stylus and ZK proposals from its forum account.

The Arbitrum Security Council and its three emergency actions of 2026

The Security Council has 12 members in two cohorts of six, and one cohort is elected each year; the March 2026 election filled six seats from eleven finalists. Nine signatures let it carry out an emergency upgrade with no delay, which the constitution reserves for “a true security emergency”. Regular upgrades pass through about 17 days of timelocks, according to L2BEAT, which counts a 10-day exit window for users on that route and none on the emergency route.

L2BEAT rates Arbitrum One at Stage 1, the middle of its three stages. It names two issues blocking Stage 2: upgrades unrelated to provable bugs leave users less than 30 days to exit, and the council’s actions are not limited to bugs that can be proven on chain. In 2026 the council used its emergency power three times.

The first came after the KelpDAO exploit of 18 April 2026, in which 116,500 rsETH were released on Ethereum without a matching burn (Cointelegraph), with effects on 11 chains including Arbitrum (L2BEAT). It was not an Arbitrum bug. At 11:26 pm New York time on 21 April, in one atomic action, the council upgraded the Ethereum inbox contract, sent a transaction in the exploiter’s name moving 30,765.67 ETH on Arbitrum One to a holding address ending in 0DA0, then reverted the upgrade. Its report on the freeze says: “To release the funds, a subsequent action must be taken by Arbitrum Governance.”

Aave Labs, KelpDAO, LayerZero, EtherFi and Compound then proposed releasing the ETH to a 3-of-4 safe meant “solely for the remediation of losses arising from the exploit”. A non-binding Snapshot poll passed with 90.96% support, Decrypt and The Block reported on 8 May. Lawyers for families holding $877 million in terrorism judgments against North Korea had served a restraining notice; on 8 May Judge Margaret Garnett of the Southern District of New York allowed the vote and a transfer to a wallet controlled by Aave LLC while keeping the families’ claim on the funds, Cointelegraph reported. As of 24 October, the binding vote and the transfer were not confirmed in the sources checked.

The second action, on 24 May 2026, patched the bridge against a governance denial-of-service issue between Arbitrum and Ethereum; L2BEAT says no funds were at risk. The third, on 2 October, froze new Stylus activations and added to BoLD a guard contract that L2BEAT describes as a permissionless circuit breaker.

After the April freeze, several delegates asked the council to publish a policy on when it steps in. None had appeared in that thread by October. In September a forum author named Reacher pointed out that the same 12 member addresses sign four multisigs on three chains, adding: “Nothing is reachable by this path today.” Replies noted that public keys are public by design and that the real question is whether the private keys were generated randomly.

Stylus on Arbitrum One: activations paused since 2 October 2026

Updated on 24 October 2026. On 2 October the Security Council set the gas cost of activating a Stylus program to the maximum value on Arbitrum One and Nova, which makes activation impossible. Its stated reason: “AI-assisted tooling has led to an increasing number of sophisticated attacks on hand-crafted WASM programs.” The council said no attack found so far allowed theft of user funds, and the docs add that findings in reviewed contracts only posed a denial-of-service risk to the chain. Existing Stylus contracts keep running.

None of them is close to expiring: the ArbOS 61 upgrade renewed every active contract on Arbitrum One, so none expires before 20 August 2027, the council wrote. L2BEAT lists the pause in its incident log. Six weeks earlier, Elara had quadrupled the maximum size of a Stylus contract.

On 23 October 2026 Offchain Labs posted a constitutional proposal, the Stylus Activation Contract. A new program would be activated only after a limited audit by an auditor of the Arbitrum Security Program, at minimum a check that the deployed code matches the submitted source, and a signature from a Foundation multisig. The DAO could revoke or reassign that signing right. The plan covers Arbitrum One only, and Trail of Bits is to audit the activation contract before the on-chain vote. Our report on the Stylus activation proposal details who would hold which power.

When we checked the forum at 17:30 UTC on 24 October, the thread had no replies and no temperature check had started. With the 42-day minimum for a constitutional AIP, Stylus activations cannot reopen through this route before December 2026. No vote date has been set.

Who builds Arbitrum: Offchain Labs, its founders and investors

The company, whose website now goes by Offchain, lists more than 150 staff in over 20 countries. Its company page names Steven Goldfeder as co-founder and CEO (a Princeton PhD in computer science), Ed Felten as co-founder and chief scientist (a former Princeton professor and White House deputy chief technology officer), Harry Kalodner as co-founder and CTO, and A.J. Warner as chief strategy officer. The company also acquired ZeroDev, a developer-tools firm, and worked on Prysm, an Ethereum consensus client.

It says it has raised $124 million. TechCrunch reported a $20 million Series A in April 2021 and a $100 million Series B in August 2021, led by Lightspeed Venture Partners at a $1.2 billion valuation, with Polychain Capital, Ribbit Capital, Redpoint Ventures, Pantera Capital, Alameda Research and Mark Cuban. Some outlets call the whole $120 million the Series B. A seed round of about $3.7 million led by Pantera in 2019 appears in secondary sources only. Company shares and ARB tokens are separate assets.

Arbitrum audits, bug bounty and security record

Forty-nine audit reports are listed in the Arbitrum docs, from 5 November 2021 to 19 October 2026, and Trail of Bits wrote 42 of them: Nitro, governance, BoLD, Stylus, Timeboost, the ArbOS 60 and 61 code, a guard for BoLD’s one-step proofs dated 15 September 2026 and the gas parameters planned for Ethereum’s Glamsterdam upgrade. ConsenSys Diligence reviewed the core contracts and token bridge in 2021 and Nitro in 2022, OpenZeppelin audited the Stylus Rust SDK three times, ChainSecurity checked the Nova fee router in 2024, and Code4rena ran a public competition on BoLD.

Immunefi has hosted the bug bounty since 31 August 2021; it pays up to $2 million in USDC for a critical bug, and anything the Security Council can fix is capped at High. The Arbitrum Security Program, open to applications since 29 September 2026, has a 12-month budget of about $7.8 million (1.76 million USDC and 25 million ARB) and 13 audit firms, among them Trail of Bits, OpenZeppelin, Certora and Sherlock.

No theft from Arbitrum’s core contracts appears in the record checked for this page. The hacks have hit applications. In July 2026 about $24 million in USDC was drained from a bridge run by the derivatives exchange AFX on Arbitrum, The Defiant reported, and Goldfeder said Arbitrum’s native bridge was not affected.

Arbitrum risks: the sequencer, the council and a token without revenue

The design scores well where rollups are usually judged: data on Ethereum, open fraud proofs, a forced-inclusion route and five years of audits. The open questions are about who can change things, and how fast.

One company, Offchain Labs, is at once the sequencer operator, the main developer, the author of most protocol proposals and the only Guild member. The council can rewrite the system with nine signatures and no notice; each of its three 2026 actions came with a public report, but no written policy limits when it acts. And ARB holders vote on a treasury that earned $6.19 million in six months while the Foundation asked for about $45 million for a year.

Faster exits are planned. Offchain Labs wants ZK settlement with Succinct’s SP1 prover, which would cut settlement “from days to hours”, its blog said on 20 August 2026. It is not live, three work streams remain, no date is given and the DAO would have to approve the upgrade.

What to watch next on Arbitrum

• Results of four temperature checks that closed on 22 October: new Arbitrum One and Nova L1-pricing parameters for Ethereum’s Glamsterdam upgrade, an L1 voting recovery system, a transfer of 1,700 ETH from the treasury, and USDG as a core strategic initiative.
• The next ARB unlock, to the DAO treasury, on 16 November 2026, per Tokenomist.
• A temperature check, then an on-chain vote, on the Stylus Activation Contract, with the Trail of Bits audit of that contract published first.
• The last team and investor unlock on 16 March 2027.

The ZK settlement proposal has no date yet, and the Arbitrum blog itself warns that its roadmap statements are “not commitments or guarantees”.