My understanding was that an illicit fund withdrawing was possible because of a bug in the contract code (more specifically a recursive call loophole), and the community executed a hard fork to return those funds to their original owners. I’m curious as to what I’m misunderstanding here.