Original title was something like "Enigma's ICO hacked, $500,000 stolen. CEO reused password. No 2FA."

For one, my understanding is that the Enigma's "website, email lists and other property" was compromised, not it's "ICO". Second, the $500,000 was scammed out of users/investors rather than directly stolen in the "hack". I think for crypto-coins this is an important distinction.

Well, it seems unfair to say "investors lost 500k" if they weren't really investing in the ICO so much as taking the bait on a phishing email, which is what it sounds like happened. If a hacker took control of their domain and Slack, and socially engineered people into sending funds into the hackers' personal accounts (which is what it sounds like has happened), Enigma never really had the funds to lose in the first place themselves.