The attacker used a flash loan to manipulate prices and drain the pool.

Flash loans are also used legitimately for arbitrage, collateral swaps, and self-liquidation.