Tinyman's AMM pools were exploited via a vulnerability in the liquidity withdrawal mechanism. An attacker could receive the same token twice after a burn rather than two different tokens, extracting twice as much liquidity as authorized. The initial attack was imitated by others, with approximately $3M in losses and $2M in additional at-risk liquidity before the team urged removal from all pools.