1/ Just yesterday we were discussing CPIMP attacks, and now we have a live example: @USPD_io has been exploited for ~$1M via a malicious backdoor proxy planted over 2 months ago.
All the drained funds were swapped to ETH. The exploiter currently holds ~$1.05M at this address: 0x083379bdac3e138cb0c7210e0282fbc466a3215a
This wasn't a flash loan attack but a sophisticated "sleeper" job.