The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad becau

The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server. So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one. Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.