It's a common misconception that a "cold wallet" is offline. It's still on the blockchain like any other wallet, it's just the keys that aren't on any network-connected computer.

It appears that in this case hackers managed to trick Bybit employees into entering the keys into a fake UI that gave the hackers access to them.