An attacker gained control of TesseraDAO's core contract and used ownership privileges to mint 99M TSR tokens from nothing, swapping them for $2.49M USDT. The attacker reassigned roles, seized ownership, and drained the treasury by dumping the freshly-minted tokens on Uniswap before withdrawing through Tornado Cash. The exploit went undetected for 19 hours after the mint.