The attacker used spoof tokens to exploit price curves and reserve calculations, manipulating liquidity to extract real assets.