A reentrancy vulnerability in vaults.sx's flashloan contract allowed an attacker to recursively extract 1.18M EOS and 462K USDT. The attacker distributed funds across 246 accounts attempting to evade recovery. EOS BPs froze accounts by supermajority consensus and the attacker was social-engineered into nulling their keys; all users were made whole.