The hacker cloned the site, hacked the DNS, and pointed the cloned site to a malicious address. People then had no idea they were using the bad address and funds were stolen.
EtherDelta:
"Dear users, we have reason to believe that there had been malicious attacks that temporarily gained access to 
https://twitter.com/etherdelta/status/943580458616541184
- etherdelta