In 2011, Facebook had several now-fixed vulnerabilities:

The engineer, caught off guard, opened the malicious attachment, and the hackers were in. They quickly moved to escalate their privileges and gain access to sensitive data.

The only real “hacks” in 2011 were:

The Facebook Hacker v11.44 incident highlights the importance of skepticism when it comes to claims of vulnerabilities in popular software. While it's possible that a genuine vulnerability may have existed, the evidence suggests that Khaled Atwee's tool was more likely a phishing or social engineering tool designed to trick users into divulging their login credentials.

To "unlock" the hacking feature, users were forced to complete endless surveys that generated affiliate revenue for the scammers.