Its not a short amount of time to realize that your treasury has been looted. They should have had monitoring in place before they had a percentage of the locked up value.
I was not referring about the timeline from the breach but the timeline from the transfer of funds, which by their nature are visible by the blockchain and even with everything else failing wouldn't this be on dashboards and part of regular monitoring anywhere else?