Technically Twitter wasn't hacked, his machine was compromised and his session cookies were stolen. This allows the hacker to bypass two factor authentication. Because Hive works by broadcasting transactions that have to be signed, there is no "session" key to steal.

I believe some front ends will save the posting key in the local browser cache, but none of them should be saving the active key.