$2M exploit