CF token contract exposed a public _transfer function with an unvalidated 'from' address parameter, allowing arbitrary transfers from any holder. The attacker executed 6 transactions to transfer 4.2M CF tokens, converting them to 4,200+ BNB and cashing out via Tornado Cash.