BBXToken's transfer function includes a burn mechanism that transfers liquidity pool tokens to a dead address before calling sync(). An attacker exploited this to artificially manipulate PancakeSwap's pool reserves, creating an imbalance that allowed extraction of value from the pool.