I think "engineers on twitter" exposed the vulnerability. But they did not prove or reproduce theft to the best of my knowledge.