How Did the DAO Hack Use a Reentrancy Vulnerability?

In the 2016 DAO hack, the attacker exploited a reentrancy vulnerability in the withdrawal function. The attacker called the function to withdraw funds, and before the DAO's ledger was updated to reflect the withdrawal, the attacker's contract "re-entered" the withdrawal function, calling it again.

This process was repeated, allowing the attacker to drain a large amount of Ether from the DAO before the contract could update the balance. The vulnerability lay in the order of operations: the contract sent the funds before updating the internal state, a critical design flaw.