A key takeaway here is that this isn’t a “hack,” per se—and it didn’t happen over the weekend. The transfer that resulted in the moving 2.09 million EOS happened a long time ago. From Stokes’s perspective, the real problem is that the blacklist was a temporary fix, a bandaid covering the larger problem of preventing theft from bad-acting accounts.
That's wild that such a coin was able to be taken over by such a simple flaw. Whoever ransacked those 2.09M coins is laughing all the way to the bank.
I just see it as a warning to blockchain developers out there, they should be careful in checking for bugs in a program before launching out to the world for use.