I am assuming that those bitcoins were stolen from their "cold storage" a few weeks ago, iirc gmaxwell said that they automatically send coins from their "cold storage" to their hot wallets when their hot wallets were empty