The attacker used a “proxy” function to swipe victims’ USDC balances, but only a small number of Google login users have been affected.