Hacker Exploits Authorization Message Replay to Execute Massive Payout Loops

A postmortem report released on August 30 details how a hacker exploited a replay vulnerability to trigger 1,490 unauthorized payout transactions. The flaw stemmed from a mismatch in serial-number verification protocols combined with a 105-minute response delay, allowing the attacker to repeatedly reuse the same authorization message.