Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.

That's fairly risky, though, as it's very visible to users if it goes wrong, who could then alert the manufacturer, who could in turn warn other users.

I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.