Well, it looks like the root cause of this attack was a compromised seed phrase. It is not yet clear how the hacker came into possession of the keys but according to CertiK, it's either malware injection or social engineering.