On September 4, 2021, DAO Maker's vesting contracts were exploited via an unauthenticated init() function allowing contract reset and ownership claim. The attacker used emergencyExit() to extract ~$4M from vesting contracts for DERC, CPD, CAPS, and SHO.