No key was stolen and no contract was broken. An attacker passed a proposal and the protocol did what it was told — about 2,843 ETH and 1.68m USDC, roughly $8.5m.