I'm glad some people are posting on this thread, but frankly I was expecting this to get a lot more attention. This would be the first story, ever, of a person losing money who had a Yubikey and did not also have a trading API key floating out to be used. I've never used a trading bot, so I don't know if there was a mistake in granting permissions there... but this would be a Bitcoin first.
We're still missing a lot of information. For example, we don't know whether Gox claims they received a valid YubiKey code when the withdrawal was made. This may get very interesting soon though.