(Assuming of course the entire claim of having been stolen from is not a total fabrication itself.)
-MarkM-
Addresses can be linked by taint if they are spent together (ie. proof whoever spent them had access to both private keys).
A cold wallet can get tainted if its private keys are "imported" in a hot wallet (ie. at that point the cold wallet becomes "hot"), rather than the cold wallet funds being spent in a transaction to a hot wallet address (which is a probably "cleaner" way to do it, this way cold and hot wallets are kept completely distinct).
It is possible they sent funds to a distinct address (paper wallet), then later imported them, which would have tainted the paper wallet, but the irregularity in the balance seems to indicate they did not have complete, automated hot/cold wallet management. FWIW bitfinex does it, and their hot wallet balance is much more flat and boring, with just the occasional spikes.