Or the attacker had stolen the private key. But either way, I'm quite skeptical of Polychain's denial that a key was involved. We'll know for sure over the next few days at any rate.