An exploiter used a flash loan reentrancy attack to drain more than 1,300 ETH ($1.4 million) from NFT lender Omni.