An attacker compromised the SimpleChefStaking proxy contract, replacing its implementation with a malicious one. The attacker then used the forceWithdraw function to drain collateral from the Simple Staking pools, extracting USDCE and WETH. Voltage offered a $50k bounty for recovery of the remaining funds.