The article is a bit sparse on details of the actual attack; Was the original site not over https? Or was the attacked site storing session cookies in insecure cookies?
It looks like the hacker was able to log into the website's hosting provider account. The hacker then changed the DNS to point to a different server that had an exact copy of the blackwallet.co website but with a small injection of some javascript to siphon off the master keys that people were entering.
Probably a combination of the DNS hijack + no HSTS
Alternatively, let's encrypt (and probably others) has DNS based verification.