According to blockchain investigator Packshield, the hacker used a previously withdrawn pledged NFT from the Bored Ape Yacht Club collection as collateral to drain the assets.