Pike upgraded spoke contracts with new dependencies that altered storage layout, particularly the 'initialized' variable. On April 30, 2024, this storage misalignment allowed attackers to upgrade contracts, bypass admin access, and withdraw funds. The second exploit involved 99,970 ARB, 64,126 OP, and 479.39 ETH.