As Willie Sutton said, that's where the money is. https://www.nytimes.com/1979/08/26/archives/willie-sutton-sa...
(Imagine having to go to the trouble and risk of walking into a bank with a gun for a mere thirty thousand 1979 dollars, when you could steal one hundred million dollars by compromising some software!)
AFAIK the accounts are not controlled centrally. How it works is that the project owners set up a site/webapp, which has javascript that interacts with wallet extensions installed on the user's browser. Members of the DAO uses the site to do various actions, for instance buying tokens or making votes. The site sends the request to the wallet extension to be signed, and then it gets broadcasted to the ethereum network. At the end of the day, the wallets are still controlled by the user, it's just that hijacking the site allows them to fool a massive number of users that don't pay close attention.
It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds.
This is a failure of opsec.
it just happened to be an overly trusted point of failure
Absolute security nightmare in both directions, this.
I preach this in every forum I am active in, but if you are messing with more than play money you absolutely need a hardware wallet.
If your use case involves being able to control user accounts centrally, why do you need blockchain for that?
UPD: if hacker didn't do it, BadgerDAO could do it anytime in the future, when money is much more than now, so it is good that they were hacked earlier, smaller impact on end users