all he did was click a sponsored ad on his computer and all his digital assets and livelihood was gone.

Did he give out his keys, or was there something more?

Yes, it is possible for hackers to gain access to cookies with cross site scripting. In such cases, one clicks a link. The hacker can get any cookies used for validation on the site.

Ad companies that allow such ads are criminally negligent in my book.

But, it sounds like something worse happened. There must be more than a simple XSS for the hacker to get everything.

....

The twitter thread implies that NFTGod clicked an ad, downloaded a program and ran an .exe file.

An exe file could give the hacker complete access to a machine.

!PIZZA