There is no circuit breaker to halt the protocol during an incident, or some value-moving paths ignore the paused flag, so an exploit cannot be contained.
function withdraw() external whenNotPaused nonReentrant { _pay(); }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0083 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.