Attackers exploited HackDao's token fee mechanism and skim() function via flashloan, borrowing and liquidating themselves repeatedly without repaying. The contract's flawed accounting allowed extraction of 200 BNB (~$65K) before theft detection.