Looks like there is a USDC bridge possible exploit on Arbitrum! @blockaid_ detected an abnormal bridge withdrawal that extracted ~$24.15M USDC from an Arbitrum USDC custody bridge contract. The on-chain bridge logic was not bypassed; the malicious withdrawal was authorized by a quorum of hot-validator signatures and then finalized after the dispute period. Exploit tx: https://arbiscan.io/tx/0x50d0b3ec6c3f5fce0f10abf81540bbb508f421494aa2b3480c4a264b0436547b Root cause: compromise or abuse of the bridge's hot-validator signing path. Five hot-validator signatures authorized a withdrawal of 24,150,000 USDC to the loot wallet, reaching 7,142 / 10,000 validator power (>2/3 quorum). The bridge contract then treated the withdrawal as valid and released funds after the 200-second dispute period. The attacker subsequently bridged/laundered the proceeds to Ethereum: the same loot wallet received ~24.146M USDC minted on Ethereum in batches and forwarded the funds onward, consistent with movement of the stolen Arbitrum USDC.(Vladimir S. | Officer's Notes)