Web3Auth's communications also referred to an "original attacker," suggesting some funds were stolen, but did not elaborate.