Attackers forged a cross-chain message, came within minutes of a second drain, and wiped their tracks on the way out.