It was not initially disclosed where they obtained the "web wallet". Most web wallets are provided by a third party and support many coins.
In this case it was an officially supported wallet from the coin devs.

A web wallet in nothing like a full node wallet you can mine. It's a managed wallet, meaning someone esle takes care of your crypto
on your behalf, often including the keys. They are no more secure than using an exchange to store your crypto.

This case now looks more like phishing or the keys, wherever they are stored, were stolen.
So my second sarcastic reply may seem more relevant. In a less sarcatsic way, don't blindly click on links that are offered to you.

It's sad but it's the world we live in. In Darwinian terms, adapt or die.