It'd be easier to believe an insider embezzlement, or deep hack/physical-heist by outsiders, that took all cold-wallet funds in one go. A gradual drain would have given so many chances to notice, mitigate, or correct.