Security firm Blockaid confirmed the Reth state-root calculation flaw was a code calculation error rather than an active exploit, with no stolen funds reported