I used to think some variant of Peter R's theory made the most sense. What I could never quite reconcile, though, was that there was no blockchain trail of stolen coins in 2011. So I figured that maybe the 2011 hack involved the hackers copying a bunch of code, finding exploits a while later (or having installed a backdoor), and then slowly bleeding Gox in relatively small amounts over the years.

But honestly, reading that Ashley Barr thread makes me think that the whole thing more likely has a far simpler explanation; ie, Karpeles just spent a few million of the fiat deposits that came into the bank account (which was his personal account(!)) frivolously, while crediting traders with BTC. Given prices at the time (mid-2011 through 2012), it would only have taken <$5m in lavish "corporate" spending to run up ~550,000BTC in liabilities. Unfortunately there's a long history of startups proving that it's not hard to blow a few million bucks on dumb stuff.