The hackers started by using a phishing attack (where they fake a website or an email to try to gain credentials) to gain some kind of access to the exchange, according to the report. It worked, they had part of the permissions to send a transaction. But there was a problem.
The exchange had a multi-signature security setting. This means that multiple keys (like passwords) are required to send the money. So, it seemed like there was nothing they could do.
I also see a
problem with this scenario as I seriously doubt that an exchange whose operators are stupid to fail for fake emails phishing attacks is using multi-signatures
Also, another problem:
Instead they figured they would send a small amount of Ethereum to one of the whitelisted addresses but tack on an excessively large transaction fee. While they weren’t getting any of the money, they were costing the exchange dearly. And that gave them room to demand a ransom.
So, rather than simply proving with a series of small 1$ tx than they are in some kind of control they decide to trash 2 million worth of coins, and then...demand a ransom. Man, it's like kidnapping somebody for a reward and burning their family house and assets to the ground and THEN asking for money! Good luck getting money after bankrupting them.
Besides, if they would have done small transactions they could have defended themselves if ever caught with some sort of vulnerability reward testing, trashing two million to make a point it's a lost cause from the start.
