Only whitelisted addresses can peg out iirc.
This is the thing that gets me. That should have been an easy protection against this kind of hack.
1
