Starstream Finance's treasury was drained via an unprotected execute() function in the DistributorTreasury contract that allowed external calls bypassing owner restrictions on token withdrawals.