I wonder how they verified borrowers identity.

Stealing the deposits would require

a) Verification happens without any government id (I assume this is true) b) depends somehow on the bank / smart contract authors

Then it would be trivially easy to generate huge amount of "borrowers" who simply "default" on their "loan".