Based on another link posted here it looks like the hackers just called the half of a cross chain transaction that does the Eth payout. Could they not just make sure that there is a corresponding TX in the other half of their handshake rather than trusting the caller is actually their other contract