The Arbitrum ecosystem recently experienced a contract security incident. The security monitoring team discovered a series of suspicious proxy contract operations on the ARB network, involving approximately $1.5 million.

The incident was triggered when the deployer accounts of the USDGambit and TLP projects were accessed abnormally. The attacker then used this as a foothold to deploy malicious contracts on the network. Even more severely, they modified the permissions of ProxyAdmin, successfully taking control of the proxy contracts.

The stolen funds did not stay on the Arbitrum network but were transferred to Ethereum via cross-chain bridges. Ultimately, the money was sent to a mixing pool, effectively laundering it. This incident serves as a reminder to all project teams — the security management of proxy contracts and the safekeeping of private keys, which may seem basic, are critical. Once compromised, the consequences can be truly severe.