Bacon Protocol NFT mortgage lending platform was exploited via reentrancy in the lend() function. The contract used ERC777 without considering callback security, allowing an attacker to reenter lend() to obtain excessive lending credits and drain ~$1M.