In a reentrancy attack, an attacker exploits the ability to call back into a function of the victim contract before its state changes have been completed. This is often seen in scenarios where a contract interacts with external contracts or tokens. By calling back into the vulnerable function, an attacker can manipulate the state of the contract, usually to drain funds or alter the contract's state in unintended ways. A famous example of this type of attack occurred in The DAO hack in 2016, where reentrancy was utilized to siphon millions of dollars in Ether.