If their hash rate is over 50% they can "unconfirm" a confirmed transaction by making a chain with more work on it. This is how the attack plays out in simplified form:

Bitcoin is sent to an exchange by the attacker, confirmed, sold and withdrawn for cash. Attacker then makes a chain with more work on it than the chain where the Bitcoin was sent to the exchange. Now as far as Bitcoin network is concerned, the coins were never sent to the exchange, but the exchange already let the user sell the Bitcoin and cash out. So now the exchange has neither the cash or the Bitcoin. The attacker has both.