If this is what it sounds like, and the "exploit" was google indexing a bunch of URLs which allowed direct access to the funds they referenced, how did google d

If this is what it sounds like, and the "exploit" was google indexing a bunch of URLs which allowed direct access to the funds they referenced, how did google discover them in the first place? There was mention of a missing/broken robots.txt which allowed GoogleBot to index them, but what I'm stuck on is how it learned about them in the first place; where they actually doing something utterly insane like autopublishing a sitemap, or was there some bug allowing g'bot to sniff/guess the URLs? I've seen odd behaviour in my logs from google crawls in the past, like g'bot traffic within minutes of adding a new DNS entry/vhost to a domain, with absolutely assuredly no mention of it publicly available. I suppose it's possible they're watching DNS zone changes and scheduling a tentative probe, but it's a bit creepy (especially if you're disorganised and haven't got the robots.txt set up right away)