If a key was indeed stolen, they must have stole the keys to the exchange's wallet, not a user's wallet. I heard in the press conference they don't have a multi-sig wallet so all it took was one key and not multiple keys.