the timeline of the IOTA hack smells a lot like an inside job IMO. (maybe not on the management level but below?) the hack started shortly after the "reload" feature of the Trinity Wallet was released.

rhetorical question: how fast can you plan and implement such an complex attack if you are not aware of such a "reload" feature upfront?

EDIT: is the user account of Dominik Schiener not known? he has a Bitcoin history (Switzerland based Crypto exchange which did broke) and I assume he was active here on bitcointalk.org too.

https://www.iota.org/the-foundation/team