Attackers compromised a shared deployer account that managed both USDGambit and TLP contracts, likely through key theft or credential compromise. This allowed them to deploy a new ProxyAdmin contract with full control over both protocols, draining $1.5M before moving funds to Ethereum and depositing into Tornado Cash.

Multiple suspicious transactions involving proxy contracts were detected on Arbitrum (ARB), with estimated losses of approximately $1.5 million. Preliminary analysis indicates that the sole deployer of the USDGambit and TLP projects may have lost access to their account. Subsequently, the attacker deployed a new contract and updated the ProxyAdmin permissions to seize control. The stolen funds were then bridged to the Ethereum network and deposited into Tornado Cash.