Yes it was a genuine mistake introduced when trying to harden something else.

I'm not saying exactly how it was fixed but it is very fixed.

And 40,000 never left. It moved to an account and I was able to reverse that before the attacker could remove it.