Basically the hacker was able to attack each signer's device to make the multisig UI show something different from what was actually signed. That's how they got the multisig to sign away the funds. Crazy stuff.