Security firm Blockaid identified that the attacker utilized EIP-7702 authorizations to delegate account execution to an unverified 'sweeper' contract. This allowed the attacker to drain assets by tricking the signing infrastructure into approving malicious transactions, rather than stealing the private key itself.