I think the lost funds were cold storage which begs the question... manual moving of coins was needed to refill.... so how did that hack happen if its offline?
Doesn't look like cold storage. Most funds gone in one transaction, not a slow bleed via refills: