So, it uses the fact that bash allows functions with non-alphanumeric names, in this case it defines a function called :. If we rename that to, for example bomb it becomes a little clearer:

bomb(){ bomb | bomb& };bomb

This defines a function that calls itself piped into a version of itself in a separate, background, process (that’s what the & does) and then calls that function. Calling itself means the function never ends (it’s essentially a recursive version of an infinite loop) and the extra background process that is created each time it’s called means that it just keeps exponentially creating new processes that don’t exit and each of which infinitely forks off more processes until the OS runs out of resources (unless you use ulimit to set per-session/per-user process limits - this may even be done by default on some distros these days, it’s been a while since I looked)