This guy is all but admitting it was him, and is basically bragging about it.  

https://hashtalk.org/user/allcryptocoins

https://hashtalk.org/topic/30067/can-anyone-else-access-the-bulls-t-central-coinfire-cf/6

https://hashtalk.org/topic/30083/coinfire-domain-stolen/53

Someone should archive his post history before he censors it.