The contract was audited by a reputable company, so slim chance it has any vulnerabilities, more likely an end device was hacked, but we're still trying to determine that, also, my team doesn't have low technical knowledge, I'm just conducting my own investigation to present some solutions during our meeting.
Code audits are helpful but they are by no means definitive proof of anything. More than a few projects that were audited by established and respected teams have gone on to have exploits discovered upon release.
The most recent publicised one I can think of was critical exploit in MinSwap's smart contract(s) discovered by Wingriders (a competitor swap/dex on the Cardano network) once they went open source.