Somewhere between the first smart contract audit and the hundredth, the attack surface moved. Nobody noticed, except the people planning to exploit it.