Definitely both. Plenty of hackers report this kind of bug and receive a reward hopefully. The devs, assuming no intentional malice, made an honest mistake. The fallout is catastrophic, but hopefully not intentional. We’ll see. But the hacker is just pure evil.