Ragnarok Online Invasion's ROI token contract on BSC was exploited on September 8, 2022 when an attacker called the unprotected transferOwnership function. Despite the contract having an onlyOwner modifier, it was not applied to the ownership transfer function, allowing unauthorized ownership changes and theft of ~158 BNB.