It is likely that they were able to compromise the bad guys' systems and steal the private keys, which in itself is against the law.