Arbitrum ecosystem exposes new vulnerabilities. According to monitoring data, a series of suspicious transactions involving proxy contracts have recently appeared on the Arbitrum network, with an estimated initial loss of $1.5 million.

From a technical perspective, the culprits are traced back to a single deployer account for USDGambit and TLP projects. The attacker gained access to these accounts through some means and immediately deployed new malicious contracts. More importantly, they also modified the permissions of ProxyAdmin, gaining complete control over the entire proxy contract system.

The stolen funds have already begun to be transferred across chains. The hacker moved these funds from the Arbitrum network to Ethereum, then into the privacy mixer Tornado, demonstrating clear anti-tracking intentions. This serves as a reminder for projects and users within the ecosystem to remain vigilant in contract deployment and permission management, especially considering the risks associated with single-account control configurations.