Seems to me the people most likely to have 'stolen' the coins are the ones who published the hacked documents.

I've had a look and the docs seem legit, so if these 'hackers' could get access to these docs, just imagine what else they got access to.