The exploit targeted a re-entrancy vulnerability in the protocol's withdrawal function.

Post-exploit forensics often reveal that the vulnerability was present in audited code but was not flagged by reviewers.