WealthManagementV2

The attacker obtained control of WealthManagementV2’s owner privileges, suspected to have resulted from a leaked owner private key. After taking ownership, the attacker used updatePlanConfig() to set period=0 and interestMultiplier/unlockMultiplier=528,300,000.

Because the privileged configuration function had no timelock or parameter bounds, the attacker could invest and immediately redeem to generate artificially inflated interest, then use a second investment to unlock and withdraw the resulting balance.