Thunder Terminal's MongoDB connection URL was compromised, allowing attackers to retrieve session tokens and execute unauthorized withdrawals from 114 user wallets. The attacker drained 86.5 ETH and 439 SOL in less than 9 minutes.