I believe a developer is taking all the attackers transaction outputs for himself. The idiot attacker could only attack with an anyone-can-spend transaction so they're all up for grabs.