They didn't have a system set up to protect against that. Their private keys were on a shared email account
Ten years ago when my crypto was worth barely anything I had an airgapped, full disk encrypted, RasPi which required a Shamir's Secret Sharing key arrangement to unlock as my cold storage... just because it was something fun to setup.
Here a multi-billion dollar enterprise has less sophisticated OpSec. Just... wow.
A dude who plays LoL badly. Embarrassingly badly for his number of games.