Attacker drains $1.4 million from CUT token pools via mysterious unverified contract September 11, 2024