I don't know whether the key was taken. I'm assuming that is what happened. Potentially there are other ways it could have occurred as well. But the most likely situation is that the private key or keys were compromised. I know they have cold wallets but I don't know it affects their situation.

The breach occurred just before the Ethereum Constantinople hard fork was scheduled for January 16, 2019. Which keeps being postponed.
https://cryptoslate.com/ethereums-hard-fork-constantinople-what-you-need-to-know-before-january-16th/