DAO Maker's vesting system was exploited when the init() function lacked access control, allowing an attacker to reset parameters on 4 token contracts (DERC, CPD, CAPS, SHO) and drain tokens via emergencyExit. Stolen tokens were swapped on DEXes, causing significant price impact.