MoonHacker Vault on Optimism was exploited when an attacker took a flashloan of USDC from Aave, passed a malicious contract as the mToken parameter in the executeOperation function (which lacked validation), gained unauthorized approval to transfer vault USDC, and drained the vault.