Attacker drains $1.4 million from CUT token pools via mysterious unverified contract