What supposedly happened is that malware was installed on every multisig key signer's device and then the hacker showed them all a fake transaction that looked legit but actually changed the smart contract of the cold wallet to give him access.