On January 5 (UTC+8), Cyvers announced that it had detected multiple suspicious transactions on the ARB network, involving a proxy contract, resulting in a loss of approximately $1.5 million. Initial analysis revealed that a single deployer of the USDGambit and TLP projects may have lost access to their accounts, and the attackers subsequently deployed a new contract and updated the ProxyAdmin privileges to take control of the accounts. The stolen funds were then transferred to the ETH network and deposited into TornadoCash.