Perpy Finance's staking contract proxy was not properly initialized, allowing attackers to invoke initialization functions and gain control. The attacker updated the contract and withdrew 58.489M PRY tokens worth 41.895 ETH.