The exploiter used a “panic” function buried within eight different smart contracts to remove $1 million worth of users’ funds without their permission.