They found a mistake in the implementation of the system and exploited it. The underlying quantum encryption system is still fine.

It's roughly the same as attacking a swipe card system by hooking a 40,000 volt line up to the card reader. A naive implementation might fail "open", which is basically what happened to the hardware in this case.