The attacker gained whitelist access through a newly deployed contract and borrowed against the vault’s Aave V3 position.

verified span

“Blockchain security firms said a newly deployed contract gained whitelist access to the vault and borrowed against its position on Aave V3 before the assets were moved to an attacker-controlled address.”