The hacker used a flaw in its smart contract that showed released NFT as available for collateral to be used for borrowing.
