Better a mistake than a true blue hack, it means their security is more solid than thought.
Makes little sense for them to lie about it being a hack rather than a mistake. And it looks like coins have already moved from those supposedly unspendable bc1 addresses.