Visor Finance's staking contract was exploited via reentrancy in the delegateTransferERC20 interface. Attackers recursively called the withdrawal function before state updates were completed, stealing 8,812,958 VISR tokens (~$8.2M).