Is Arcus legit? Audits, custody and the risks
Disclosure: this page contains a referral link. If you sign up through it and trade perps, this site may earn a share of the fees you pay on Arcus. It does not change what we write or what you pay.
Arcus is run by a real, named company, its contracts were audited twice before launch by firms whose reports are public, and it is self-custodial, so it never holds your keys. No security incident has been reported. It also has no proof of reserves, and it blocks the United States, the United Kingdom and Canada.
The question is Arcus legit usually means two separate things: is there a genuine business behind the website, and can you still lose money even if there is. The first answer is reassuring. The second is not, and this page keeps them apart.
Eligibility first
Per the Arcus help centre, Arcus is not available in the United States, the United Kingdom or Canada. The protocol terms also exclude sanctioned persons and comprehensively sanctioned regions, naming Iran, Cuba, North Korea, Crimea, Donetsk and Luhansk, with a minimum age of 18. If you are in one of the blocked countries, the trust question is moot, and the countries page is the one to read instead.
There is a real entity behind it
The operating entity is Arcus Labs Ltd, a Cayman Islands exempted company. The protocol terms are governed by Cayman law and were last updated 30 June 2026. A Cayman exempted company is normal for a crypto protocol and tells you something about the regulatory posture: this is not a licensed broker in your country, and you are not a protected retail client of one.
The people are named and traceable. Eddie Zhang is CEO and founder; he co-founded Pocket Protector in 2024, dYdX Labs acquired it in July 2025, and he became president of dYdX afterwards. Antonio Juliano, dYdX’s founder, sits on the Arcus board. Robinhood Crypto is a strategic investor, per dYdX’s own announcement.
Two qualifiers worth holding on to. The investment amount, valuation, round name and full investor list are undisclosed everywhere, including Dealroom, so any specific number you read is somebody’s guess. And Arcus states that it is an independent DEX: Robinhood operates the chain and invested, but does not own Arcus. Anyone selling the idea that this is a Robinhood product is overstating it, and the comparison with dYdX deals with the related claim that Arcus is just dYdX renamed.
Two public audits
Arcus had two pre-launch audits with reports you can read rather than trust. OpenZeppelin reviewed the Arcus rootchain contracts, and Trail of Bits published a report dated June 2026, available as a PDF in the trailofbits/publications repository on GitHub. Both firms are top tier for this kind of work, and publishing the reports rather than just the logos is the part that counts.
Be precise about what that buys you. An audit is a point-in-time review of specific contracts against specific assumptions. It reduces the chance of a contract bug draining funds.
It says nothing about whether a market maker quotes you a bad price, whether the issuer behind a Stock Token stays solvent, or whether your own leveraged position gets liquidated. The security page goes deeper, including the documented anti-MEV mechanism.
Self-custody, and what it does not protect
Arcus says it never holds your funds or keys. Spot trades settle wallet to wallet on-chain. Perps collateral sits in Robinhood Chain contracts and moves only under user-authorised conditions. Onboarding uses Privy embedded self-custodial wallets with email or social login and no seed phrase step, which keeps the experience simple while leaving custody with you.
Self-custody removes one category of risk, the exchange that quietly spends customer deposits, and adds another, the user who loses access. It also means there is no support desk that can reverse a mistaken transfer. If something looks broken mid-session, the usual causes are gas, eligibility and bridging rather than anything sinister, which is what the troubleshooting page covers.
The issuer is a third party
This is the structural fact most reviews skip. Stock Tokens on Arcus are issued by Bitstamp Global Ltd, a BVI-registered virtual asset service provider that holds the underlying securities. Arcus is only the venue.
So holding a tokenized Tesla position on Arcus gives you exposure to Tesla’s price, to the Arcus venue, and to Bitstamp Global as issuer and custodian. Per the Arcus help centre, repeated across four separate FAQ pages, Stock Tokens carry no voting rights and no dividend claim as such, cannot necessarily be redeemed for real shares, and the token price can diverge from the real stock price. That is a different instrument from a share, and the Stock Tokens page and tokenized stocks explained go through the mechanics.
The insurance fund, and the gap next to it
An insurance fund exists. Arcus describes it as a protocol-managed reserve that pays out counterparties on liquidations that would otherwise be unprofitable, with auto-deleveraging and socialised-loss policies documented alongside it. Its size is not published, which limits how much comfort you can take from it. The liquidations page explains the order those mechanisms fire in.
The larger gap is proof of reserves. The documentation says reserves are intended to be publicly attestable. Intended.
There is no attestor, no cadence and no attestation link as of 2 October 2026. For a venue whose core product depends on real securities sitting with a third-party issuer, that is the single most useful thing it could publish and has not.
Track record, and the volume question
No security incident, exploit or outage appears in any source checked on 2 October 2026. Written honestly, that is none reported, not none ever: the protocol has been live only since 1 July 2026, which is a short record by any standard.
The usage numbers are also unsettled, and the honest version is to show both. Arcus, via The Block on 1 October 2026, reports more than $5 billion cumulative volume, more than 15,000 unique traders, more than $28 million TVL and 190+ stock tokens. The DefiLlama API the same day reported $1.02 million over 24 hours, $27.1 million over 7 days, $111.2 million over 30 days and $343.8 million all time, while CoinGecko counted $2.31 million of 24 hour spot volume across 162 pairs that week. The gap is most likely spot-only tracking versus perps notional, but DefiLlama’s methodology could not be confirmed, so it stays unexplained rather than resolved.
What stays risky even if everything above checks out
Leverage is the main one. Perps run up to 50x depending on the market, and most leveraged traders lose money. A liquidation does not need the platform to fail; it only needs the market to move against you.
The beta fee schedules are temporary. Perps taker fees have been halved since 20 July 2026 and maker fees have been zero for tiers 0 to 4 since 4 August 2026, both stated as applying for the duration of beta. Price your strategy on the standard rates in the fees breakdown, not the beta ones.
Points are not a payout. Season 1 began 1 October 2026 and Arcus calls points a participation metric only, with allocation at its sole discretion. There is no Arcus token: the help centre says so verbatim. Any site advertising a confirmed Arcus airdrop contradicts the issuer’s own documentation.
And identity verification is an open question. Arcus does not say in public documentation whether it requires verification, and absence of a stated requirement is not a published policy either way.
Nothing on this page is financial advice, and this site is not connected to Arcus. If you want the balance sheet version of the same material, the review sets what works against what does not.
Questions people ask
Has Arcus been audited?
Yes, twice before launch, with public reports. OpenZeppelin reviewed the Arcus rootchain contracts and Trail of Bits published a report dated June 2026, available as a PDF in the trailofbits/publications repository. Audits reduce contract risk; they do not remove market or counterparty risk.
Has Arcus ever been hacked?
No security incident, exploit or outage was found in any public source as of 2 October 2026. That is accurately stated as none reported rather than none ever, since the protocol has only been live since 1 July 2026 and absence of reports is not proof of absence.
Who holds the real shares behind Arcus Stock Tokens?
Bitstamp Global Ltd, a BVI-registered virtual asset service provider, issues the Stock Tokens and holds the underlying securities. Arcus is only the trading venue, so your exposure to the issuer is separate from your exposure to Arcus.
Does Arcus publish proof of reserves?
Not yet. The documentation describes reserves as intended to be publicly attestable, which is an aspiration rather than a live report. No attestor, cadence or attestation link exists as of 2 October 2026, so there is nothing to verify independently.
Does Arcus require identity verification?
Arcus does not state either way in its public documentation, and an absence of a stated requirement is not a published policy. Treat the question as open and expect verification to be possible at some point, particularly on fiat funding routes.
Is Arcus available in the US, UK or Canada?
No. All three are blocked, along with sanctioned persons and comprehensively sanctioned regions named in the protocol terms. Eligibility is the first thing to check, because nothing else about the platform matters if you cannot open an account.