Web3 security firm’s mistake exposes victims of $50m exploit to wallet drainer