SAFETY ALERT chainId 788988 (Arbitrum Orbit, AnyTrust). Your bridge 0xC82dd3713f5eB5053D5A1a47f456435054ec77Dc holds 3.4018 ETH of user deposits and is being drained. Attacker 0x4428BE9125AE4e476514776a72ceDF2d5ce269C2 already opened the validator-AFK whitelist (tx 0xeb171e9af3318549c1ab313f3848945f46b1a1f1750ae7bb9651ef1339ec4ee5) and staked a forged node 716 (tx 0xbf303c72fcc4f47a12622b1a19fa3fbba58501ea4af7449fa574bc3089f7b93b). They can confirm after L1 block 26005988 (~2026-09-18) and then withdraw the escrow. FIX (no stake needed): Safe 4-of-11 -> UpgradeExecutor 0x1AA00161Fe7381af1Fc4C45cB8895E3901b844Bd .executeCall(rollup 0xe58A48B6d03cCbcb0c5B8e8BB76682564EF02899, setValidatorWhitelistDisabled(false)). Same exposure on your other chains 7889 and 78898. Full analysis + PoC available on request.
📤 From: 0xf826683060f021fc438eb8800a07a1b7bc844feb
📥 To: 0x81175155d85377c337d92f1fa52da166c3a4e7ac
🌎 Network: arbitrum
Etherscan