The 796 exchange suffered from a vulnerability in its withdrawal system that allowed attackers to modify withdrawal addresses. A hacker exploited this by submitting a withdrawal with a modified address that the exchange staff failed to notice, routing 1,000 BTC to the attacker instead of the legitimate customer.