Rari Capital's Fuse lending pools were exploited via a reentrancy vulnerability in exitMarket() when an attacker used a Balancer flashloan to deposit collateral, then recursively borrowed assets and withdrew collateral before borrow records were updated, stealing approximately 28,380 ETH and related assets.