Of course they did, if they made it look simple then everyone would freak out (or they should, and have mass exodus away from Citi). People are used to hackers finding occasional, difficult exploits.