By exploiting a bug, the attacker caused liquidity to be "double counted," allowing them to get an unfair price for a swap.