but surely the CoinDash admins should have noticed that no ETH was coming into their real account after the ICO was opened?
Right? Unless this was executed in 10s of seconds, then it seems like most of the damage could have been mitigated . I'd imagine all eyes are glued to the legitimate address upon release.