Aurellion suffered an exploit that drained about 455,003 USDC. According to SlowMist, the attacker abused an unprotected initialize(address) function in the SafeOwnable Facet, used reentrant initialization to change ownership of the Diamond contract, and then called diamondCut to add a malicious Facet with pullERC20 functionality. That contract-level access enabled the attacker to move USDC, showing how weak initialization protections in modular smart contract systems can lead to ownership compromise and fund theft.