not so perfect. But this happens, a lot. sometimes they don't even hide it. The defi degenerates call it 'rugging', eg: rug pull. Often its not even a hack, the contract has an administrative function that allows draining the contract.