An attacker exploited Ambient Finance's single-contract architecture by transferring 50 ETH to a newly created contract and extracting ~83.72 ETH via insufficient access controls in the deposit/withdrawal logic.