The attackers directly accessed wallet-related backend servers to insert fraudulent withdrawal comments