The attacker reportedly used leaked Rollup infrastructure keys to forge IBC transfers. Most remaining assets in the custody accounts are still on the paused chain