According to the security company SlowMist cyberattack was executed on a bug related to the protocol's cross-chain functions. This exploit allowed the hacker to take USDC out of the poly smart contract on the MATIC system and move them to the hackers wallets. Once the hacker got the funds they sent them to a smart contract to hold the USDC. Later the hacker returned the funds to the poly network.