Key Highlights:
- $1.5 million were stolen after attackers exploited proxy contract controls on Arbitrum.
- Single compromised account allowed takeover of USDGambit and TLP contracts.
- Arbitrum’s ARB token price affected because of this incident.
Cyvers issued an alert on social media platform X today, January 5, 2026, after it spotted suspicious activity on Arbitrum network. According to the tweet, about $1.5 million has been stolen through proxy contract manipulation that targets the USDGambit and TLP Projects. The incident also flashes light on vulnerabilities that exist in DeFi smart contracts.
🚨ALERT🚨Our system has detected multiple suspicious transactions on the #ARB network involving a proxy contract, resulting in an estimated loss of ~$1.5M.
Preliminary analysis suggests that the single deployer of the #USDGambit and #TLP projects may have lost access to their… pic.twitter.com/QHwxdRO0Bu
— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) January 5, 2026
How the Proxy Hijack Unfolded
As per the post by Cyvers on X, it seems like the breach began when the attackers managed to gain control of a single deployer account that was used to manage both USDGambit and TLP projects. This would have likely happened through a private key that must have been compromised or login session must have been hijacked, which gave the attacker the same permissions as the original project operator.
With this access, the attacker may have quietly introduced a malicious version of the contract, which replaced trusted logic with code that was designed to siphon funds.
The critical turning point came in when the attacker seized control of the ProxyAdmin role. In smart contracts that can be upgraded, ProxyAdmin acts as the “master key,” which determines who can modify or can upgrade contract behaviour.
Once this control was transferred, the attackers then drained approximately $1.5 million worth or assets, which included stablecoins and ETH, right from the affected contracts.
After getting the funds out, the attacker very smartly moved them off Arbitrum through a cross-chain bridge to Ethereum’s main network. Now from here, the assets were then sent through Tornado Cash, a privacy tool that mixes transactions so that the origin of the transaction cannot be traced.
The Arbitrum network’s low transaction fees and rapid processing helped the attacker execute each step very quickly, which limited the window for detection or intervention of any sort.
This incident is also putting spotlight on DeFi projects because a single compromised control point in upgradeable smart contracts can cascade into large-scale losses, reinforcing ongoing concerns around DeFi security and access management.
ARB Price Dips
This fallout from the USDGambit and TLP hack has had its impact on the price of the Arbitrum token.
At press time, the price of the Arbitrum token stands at $0.2117 with an uptick of 0.3% in the last 24 hours. However, in the past hour there has been a decrease of 0.7% as per CoinGecko.
This drop indicates that investors have become cautious right after the breach was made public by Cyvers Alerts.
Hack Highlights DeFi Security Risks
This incident highlights how risky it can be to invest in smaller DeFi projects for the investors. A single account controlled important settings and once the hackers had the access of the account, they were easily able to drain funds.
There were no emergency stop features or backup plans in place, and hence the user had no way to protect their money once the attack started. It also shows how complex smart contract systems, even though powerful, can fail if they are properly not secured.
Even though the hack affected only small projects, this incident has managed to shake user confidence across the network, reminding investors that security gaps in one area can easily impact trust on the entire platform.
Also Read: Unleash Protocol Hack Drains $3.9M Via Multisig Exploit
