An OpenSea bug let attackers snatch Apes from owners at six-figure discounts