Cyvers detected multiple suspicious transactions on the ARB network involving a proxy contract, resulting in a loss of approximately 1.5 million USD.

Preliminary analysis shows that the sole deployer of the USDGambit and TLP projects may have lost access to their account. The attacker then deployed a new contract and updated the ProxyAdmin permissions to control the account. The stolen funds were subsequently transferred to the ETH network and deposited into Tornado Cash.