I'm not entirely sure they used the app_secret was leaked, unfortunately i don't log the authentication mechanism in the API. Either that, or all the betterbet's users access tokens.

I'm waiting on the betterbets developer to get online so we can discuss and finish piecing together exactly what happened