Ethereum contracts are not 100% immutable. They need to maintain state like a token‘s balance. That’s why Ethereum‘s VM supports contract variables. You can al

Ethereum contracts are not 100% immutable. They need to maintain state like a token‘s balance. That’s why Ethereum‘s VM supports contract variables. You can also use variables to store addresses to other contracts and call external methods indirectly using these pointer like structures. If I understood the bug correctly, the hacker was able to modify such a pointer and redirect all transactions to a wallet contract she controlled. So this is how you can upgrade contracts: There is the „implementation contract“ pattern. Basically, you define a user-facing proxy contract defining the interface but all it does is delegate user calls to the actual implementation contract by maintaining a variable pointing to it. Using a privileged call you can update that address even after deploying the proxy.