Here's how a small weakness in the platform's governance system allowed hackers to drain $8.5 million in a few hours.