Somebody managed to trick the exchange into signing a message saying "move this amount of money from this address to this other address" (signed by the private key associated with the first address, with the second address being owned by the attacker) and submitting it to be added to the blockchain by a miner.

The blockchain is the only record of who owns what money, and transactions on it can't be reverted. Therefore, the attacker stole money by causing a transaction that shouldn't have happened.