A front-end exploit injected malicious code, tricking readers into connecting wallets—here’s how the scam worked and how to stay safe.