Quote from 4Chan:

PoWH did not INTENTIONALLY have a backdoor. The entire contract was drained because of something called an overflow bug.

function transfer(address _to, uint256 _value) public {
transferTokens(msg.sender, _to, _value);
}

The thief passed in an argument value of ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, the largest possible unsigned integer which overflowed and allow the contract to pass any checks to see if he had any balance.

The transfer function then triggers a sell on tokens he doesn't even have.

An alternative team, EthPyramid.com, is working to completely audit code, patch the bugs, and relaunch with new features such as 10% selling dividend to holders. Anyone can join in and help test and ensure that the contract is robust and transparent.

Note: I am not personally affiliated with any of these organizations. I simply run the community