Haseeb explained how Arbitrum technically confiscated the hacker's assets: The Arbitrum Security Council used emergency powers to inject an ArbitrumUnsignedTxType, forcibly transferring all 30,765 ETH from the attacker's central address to a protocol-controlled recovery address. The so-called ArbitrumUnsignedTxType can only be injected by the chain itself (via the sequencer/ArbOS upgrade path, controlled by the Arbitrum Security Council). It completely bypassed the attacker's private key. In other words, the Security Council utilized a privileged state override transaction type (which is part of ArbOS but has basically never been used before), allowing the attacker's private key to still sign transactions, but the ETH in that address was transferred by the chain itself.