Ostium and AFX were drained inside eight days – both times through keys, not smart contracts. The seven questions you must answer before any deposit.