An attacker exploited insufficient verification controls in the multisig transaction process to redirect an airdrop transfer. A lookalike address was substituted for the GUA token claim contract, allowing the attacker to intercept the transfer.