Currently looks like the attacker had legitimate access to the required keys, so perhaps more of a traditional compromise rather than a cryptocurrency/contract centric one.