This is how Bitcoin works: anyone with the private key can move funds. The only thing that's left now is find out how the private key was leaked, and make sure it never happens again in the future. Considering the funds involved are quite significant, they should only have been send to a cold wallet. Hot wallets are inherently risky.
I know, I was just wondering how it was possible to send a Tx that was spending unconfirmed deposits (i.e. with 0 confirmation). I don't think you can do that with ETH, for example. But I guess BTC allows that. Interesting.