If you've ever had to log into an online account, you're likely familiar with a CAPTCHA ID verification box.
Attackers forged a cross-chain message, came within minutes of a second drain, and wiped their tracks on the way out.