the input to the large transaction came entirely from the other large mtgox transaction of June 12th, which Tux explained at the time as being a security move to put majority of mtgox BTCs offline.  So we can be fairly confident the transfer was from MtGox offline storage.  Also, based on the numbers the full offline balance was moved.  So that makes sense.  I don't believe those BTC were available for withdrawal from mtgox.  For example, when I withdrew from mtgox a few days ago (spooked about increasing account compromise reports), the trx inputs were from 5 separate addresses.  I assume those are the online accounts and are the ones available for withdrawal, subject to daily limit.  I think it actually makes a lot of sense that he would re-secure the 400,000 offline BTC storage first thing when he woke up - before logging into IRC - even if he wasn't yet sure if an attack was in progress.