The incident report, incl. the (rough) attack paths, can be found here: https://humanityprotocol.notion.site/H-Token-Incident-Update...