You copy the receiving address from your wallet, switch to your exchange window, paste it and confirm the withdrawal. If what is known as a clipper is running on your computer, the address you pasted is no longer the one you copied. It belongs to the attacker, it is technically entirely valid, and your wallet has no reason to reject it. The money is gone as soon as the transaction is confirmed.