The account of a moderator from the nonfungible token project was compromised in the attack, posting a phishing link that drained user wallets.