vendors account for the bulk of the stolen coins. Apparently the site made some feeble excuse and ceased vendor withdrawals for a week. That is a lot of escrow build up. Some social engineering with a trusted vendor or two kept things from going pear shaped too fast, and then they made off with all the escrow when the jig was up.

Before people say well it is a problem peculiar to pathetic junkies, the same thing could happen to anything in the BTC world that is very popular: An E-commerce site, a tumbler, e-wallet service, btc exchange, you name it.  With sufficient incentive (a lot of btc in transit and a spike in price) the same thing could happen either on purpose or opportunistic or a hack, of course.