The attacker took advantage of the lack of slippage control of liquidity conversions to steal the funds.