Pedro Magalhães, a blockchain developer who claims to have reverse-engineered Brazil’s pilot CBDC has found code that would allow accounts to be frozen or drained at will.