Attackers compromised a private key belonging to the game's creators, which allowed them to drain wallets that still had an active session with the game.
Around 9,000 wallets used with Cardex fantasy trading card game compromised
Around $400,000 in ETH was stolen from around 9,000 wallets on the Abstract layer-2 network, which is built by the same company that makes the Pudgy Penguins NFTs. It appears that the affected wallets had all been used to play Cardex, a fantasy trading card game that had launched only a week prior.