3-year-old bug triggers $1.3 million drain and forces 10-day blockchain halt