The proxy admin role (which can upgrade or change admin) is mis-assigned, exposed, or its transfer is unprotected, allowing an attacker to become admin and upgrade to malicious logic.
function changeAdmin(address a) external onlyAdmin {
require(a != address(0)); emit AdminChanged(admin, a); admin = a;
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0036 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.