There was supposed to be a whitelist of withdraw addresses. Maybe it was also a break in the range proof but there would have had to be a second bug. Seems more likely there was a software bug in the ...
I'm trying to find the raw pegout transaction to see if there's anything odd in it.
1