speculated scenarios based on limited stuff said:

"email notifications from kraken/coinbase"
maybe the hacker got the the coins he had on an exchange

or

he uploads binaries for his bitcoin knots node to his server. hacker replaced binary with compromised on. luke downloaded binary from server without checking (who actually checks their own work if you beleive you were the one that uploaded why check the binaries twice)
and then put his keys into the compromised binary of bitcoinknots and "byebye bitcoinio"

both seem more plauible than a burglar entering his house.. again she would notice and not be questioning the how if his house was compromised