Developers suspect the attackers used malicious software to access the admin wallet’s private keys.