A vulnerability in the Maestro Router 2 contract behind a Telegram trading bot allowed attackers to execute arbitrary external calls, pulling tokens from user wallets that had granted the router approvals. Maestro identified and fixed the exploit within about 30 minutes and paused trading.