Hedera confirms exploit on mainnet led to theft of service tokens