Hackers exploited a variable naming error in the WETHCalculator.sol smart contract, where 'amount' was used instead of 'lockedAmount', allowing unauthorized drainage of over 400 ETH from the liquidity mining pool.