Why was the majority of this not in a cold wallet?
This.
Based on the OP I assumed (incorrectly) that the attacker "only" got 100% of the hot wallet.
Even tho only a small majority of the coins are ever in use at any time
Yes. I realize this. I cannot undo it (believe me, I would if I could).