Crypto security researchers say the hacker exploited a bug allowing them to mint tokens, before swapping the freely-gained tokens for another tied to Bitcoin.