1. 1

TL;DR - when using the EtherDelta distributed exchange, private keys are held in the browser session. Someone created a smart contract with embedded Javascript in the name that was executed in the browser.

  1.