Security firm Zealynx noted that blockchain rules requiring a private key to authorize transfers hold true only up to whoever controls the protocol's upgrade path

From the articleArbitrum's Security Council Can Move a Wallet's Funds Without Its Key, Binance Freeze Shows - UnchainedAlso in Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key