Same way as vanity onion domains: brute force. Anything else would be a security flaw. If you're asking how to actually get one yourself, just search for "bitcoin vanity address" on github. There are plenty of projects to choose from.