1/4 to 1/3 of the coins still are accessible by Gox and could potentially be refunded to customers.

Very few of the missing coins were stolen via the method that Gox (Mark) publicly stated. 
        Reference: http://techcrunch.com/2014/03/27/experts-found-that-mt-gox-lost-a-mere-386-bitcoin-due-to-transaction-malleability/

One theory is that the missing coins were spent by Gox on daily operations though I find problems with that.  Gox was quite profitable earning some months in the millions of dollars.  Their spending was lavish but not that lavish.  They did not apparently go through hundreds of millions of dollars worth of coin with just business expenses.

Another more likely (in my opinion) theory is that a large chunk of coins were simply 'lost' in an effort to enrich an insider.  Many people think they know who that is, but it really could be a number of people.   One clue, part of the initially 'lost' 200K coins were moving while Gox claimed they were lost.  It is VERY unlikely that a server was just doing that on its own.  Someone in my opinion was trying to take those coins and were caught by astute blockchain watchers.