The attacker received 74.5M ARB through a normal signed transaction. Those ARB have already moved to a new wallet. A 122K ETH wallet began funding new addresses. The activity points to multiple compromised wallets.