I had never heard of this bridge before the attack. The fact that a project manages to attract half a billion in capital unfortunately doesn't say all that much, since so much capital is flowing in so fast to every project with a pulse.

And the bug wasn't really obvious, although the lack of input sanitation is something an auditor (given enough time) would probably point out.