An exploit of the gap created when a contract sends assets out before it updates its own internal ledger — before the contract has a chance to record "this has already been withdrawn," the attacker repeatedly calls the same withdrawal function, tricking the contract into believing each call is a brand-new request, and drains the assets within a single transaction.