I dont have the full story but understand that it had something to do with the code allowing anyone to initialise existing wallets over and over again. The patch only allows initialisation once. Not sure how this bug allowed control over someone else's wallet.