Everyone concentrating on iota being a bs cryptocurrency. Which fair enough but i think that kind of burries the actual story:
People trying to make a currency involving large sums of money don't even have the security controls to check they are not loading malicous dependencies from npm! This is not some fancy crypto hack, this is plain old boring compromised dependency from an ecosystem with a reputation for high profile compromises.