The sophisticated attack exploited a loophole that tricked the protocol into releasing $500,000-worth of tokens.