The attacker used a flash loan governance attack to temporarily acquire enough tokens to pass a malicious proposal.

Flash loan governance attacks caused many protocols to implement snapshot voting based on past token holdings rather than current.