According to CoinMeta, the SlowMist security team detected an unverified contract that exposed an unrestricted low-level call vulnerability due to a selector of 0x42be3129. Lacking access control and target data validation, 16.6 WETH were stolen. The attackers exploited the contract's existing ERC20 authorization limit to bypass owner checks and perform unauthorized transferFrom operations.