According to blockchain investigator Packshield, the hacker used a previously withdrawn pledged NFT from the Bored Ape Yacht Club (BAYC) collection as collateral to drain the assets.