The tokens were stolen by someone who compiled vanity addresses eligible for ARB airdrops.
Arbitrum airdrop: Hacked vanity addresses used to siphon $500K [cointelegraph]
The tokens were stolen by someone who compiled vanity addresses eligible for ARB airdrops.