Hacker breaches DeFi lending platform, but ‘forgets’ to withdraw his $1mn exploit