A private key controlling the OPSEC staking contract was compromised, allowing the attacker to change ownership from the team wallet to attacker-controlled addresses. Although $800K in tokens were accessible, the attacker was only able to convert ~59 ETH (~$100K at time of sale) to cash due to illiquid pool conditions.

The OpSec staking contract was maliciously upgraded, allowing the attacker to withdraw and sell OPSEC tokens worth approximately 59 ETH (around $182,000).