All the balances and stuff are public on the blockchain. It only takes one person to write a script to verify that the locked up amount matches the number of tokens out there. and when it doesn't, alert.
That then means any attacker will have to be very quick with their theft, and if so, there is still a good chance whatever coins they get will end up blacklisted or the transactions reversed by a sufficiently large army of upset users who fork the eth network or the L2 network.
(They have administrative controls for now during development, at some point they're supposed to turn it completely permissionless...)
https://help.hop.exchange/hc/en-us/sections/4405172442509-FA...
Edit: O...kay? Apparently the parent of this comment is aware of alternate, much-faster ways of withdrawing L2->L1, and what their constraints are, but still elected to leave those out and imply the one-week lag was a binding constraint?
(Would have posted as a reply, but my comment rate is getting throttled for some reason.)
Edit: Sorry for being disingenuous and unnecessarily curt in my reply. I didn't mean to. I'm in some kind of weird zombie mode this morning.