A June patch did not reach affected Polkadot systems before the $1.38 million dotUSD pool was tapped in October. The treasury absorbed the loss; Parity says no user has lost any money. The attacker bypassed the Snowforks relay outage with his own relay.