The attacker successfully moved funds by authorizing transactions directly from customer deposit addresses. This implies the compromise of either the individual private keys for those addresses or, more likely, a systemic compromise of the exchange's signing architecture—such as a master key or a signing service—capable of generating valid transaction signatures for a massive number of accounts.