From what I understand, they were only able to do this because the funds were still sitting in an intermediary account and had not been moved into an actual NYC account. If the funds had been moved, they would have had to ask for the funds back from NYC instead of just taking them.

I can’t remember if my source was an article or a podcast, but I know it was a few days to a week after the incident happened because all of the initial reporting was framed exactly like this.