Cyvers reported that the attacker '0xc49b5' had initially worked on Infini’s contract but never relinquished full control. This oversight allowed them to manipulate the system long after deployment.