An Arbitrum address appears to have nabbed over 933,000 ARB tokens from over 630 wallets through an "address poisoning" scheme.