The multisig triggered an emergency pause within minutes of detecting the unusual drain.

Well-designed protocols grant emergency pause rights only to a time-locked multisig to prevent abuse of the mechanism.