ORE's staking program had a smart contract bug that let an attacker claim 25.5 SOL. User deposits are safe, but stakers must migrate to a new contract.