It looks like the hacker was able to log into the website's hosting provider account. The hacker then changed the DNS to point to a different server that had an exact copy of the blackwallet.co website but with a small injection of some javascript to siphon off the master keys that people were entering.
It looks like the hacker was able to log into the website's hosting provider account. The hacker then changed the DNS to point to a different server that had an exact copy of the blackwallet.co website but with a small injection of some javascript to siphon off the master keys that people were entering.