Is there some reason you don't consider the statements they make on their website to be evidence? From https://xapo.com/#aboutVault

In addition, the Vault is fully-insured, backed by Meridian Insurance. The insurance is provided at no charge to Vault users and covers all incidents that are not caused by you. For example, the insurance covers attacks by hackers, theft by a Xapo employee, a break-in at the physical vault location, and our bankruptcy. In this event, any bitcoins you lose will be replaced by Xapo. The only thing you’re not insured against are your own actions or error, for example, if you don’t follow basic security precautions (like picking “internet” for your password) or if you give you password to someone else who then steals your coins.

"Theft by a Xapo employee" is right there in the list.