Attackers exploited the DMT token airdrop claiming process by tricking users into signing additional authorization transactions. After users claimed the airdrop, attackers triggered secondary signatures to approve asset transfers. Thieves stole from thousands of users and cross-chain bridged over $130K in assets to Ethereum, with most funds flowing through HitBTC.