Arbitrum airdrop: Hacked vanity addresses used to siphon $500K