BNBS token on BSC was exploited via a reentrancy vulnerability where the contract failed to update state before transferring funds. The attacker invoked the vulnerable function repeatedly before completion, draining funds from the contract.