The news is not that "ATM" was drained money but that user wallets were drained. They were managed by this company somehow? If it can simply refuse to take responsibility, who can say it was not the company itself? Just "hack" your own users this way when you are tired of running the business or need an extra lambo.