The quoted text seems to talk about finding a collision of a 128-bit hash function with the Birthday attack. In a birthday attack, one creates around $\sqrt{2^{128}} = 2^{64}$ messages so that they expect to find a colliding pair with 1/2 probability.
In the described attack, Oscar wants to create two specific messages.
$x_1$= Transfer \$10 into Oscar’s account
$x_2$= Transfer \$10,000 into Oscar’s account
In order to create $2^{64}$ messages, one can use invisible characters like the space and tab. If you append 64 characters to $x_1$ or $x_2$ those are either tab or space then you can get 64 locations. This makes $2^{64}$ messages that have the same meaning with high probably different hashes.
The invisible modification applies both $x_1$ and $x_2$.
Now, Oscar sends you the message $x_1$ with hash and sign parameter and you verify it. Later oscar claims that they sent you $x_2$. They show you that the signatures are the same as the previous and here we have the conflict to resolve.