The attacker gained access to the server’s management panel through webhooks. On-chain data reveals 13 wallets believed to have been