An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.