TechFlame News: According to on-chain investigator Specter, the incident is more likely an internal operation. The address responsible for transferring the tokens has been granted the required role since 2025, and this role was only revoked after the tokens were transferred out.