A blockchain security firm said that the attacker gained special privileges to the DeFi protocol six days ago.