The attacker used a flash loan to buy 4.6 million BONE tokens, gain majority validator power, and siphon assets from the bridge.