This private key necessarily belonged to one of the owners/creators of the contract. It's very easy to find the culprit.

According to PANews, cybersecurity firm SlowMist has reported that a hacker, identified as Infini, has exploited smart contract vulnerabilities to steal significant amounts of USDC. The hacker, demonstrating advanced technical skills and a deep understanding of smart contract operations, managed to use a single private key to access and drain funds from the Vault and related strategies twice. The first theft involved 11,455,666 USDC, while the second amounted to 38,060,996 USDC. These incidents highlight the ongoing security challenges in the cryptocurrency space.