well, thats strange...since 1Ninja was the cold wallet address, the "hacker scenario" does not make any sense. if someone had access to the cold wallet, why would he only take parts of it?
The discrepancy with the amount of funds in cold wallet is what was possibly the final straw causing dmf to run. He was being questioned(even in this thread) about it. The way I remember it he said that they no longer kept all the funds in the 1Ninja because coinbase had tagged it as a gamble address....