I expect the attacker either found a contract allowing them to short ether, or made some similar arrangement. Unless it's an attack on tech itself for personal reasons, someone's getting a lot of real money today...