Yeah, in hindsight it was probably for the best. I've spent a significant amount of time going through the blockchain records, and elementus have come to a couple of the more obvious conclusions: that cryptopia had most or all of their private keys stolen, and that cryptopia seem to have lost access to their key management software / hardware and were powerless to do anything. New Zealand police are claiming that a "new breach" is incorrect information. The blockchain records seem to show new transfers to the hack wallets, and some seem to be the same wallets being swept again. The police may be considering those funds as 'already stolen' since cryptopia haven't had access to those private keys since the hack, and the hacker just moving funds around accounts they already control, rather than gaining control to new accounts.
https://www.stuff.co.nz/business/110287959/police-dispute-claims-more-cryptocurrency-taken-from-christchurch-company-cryptopiaPersonally I tend to think it was done with the assistance of an insider, in particular someone who had access to the private keys, or the hardware that the private key server was operating on. Cryptopia may have had backup key management software, but one would presume that their access to the keys was removed, and thus their backup would have been useless if they didn't have the new passwords. I imagine that if they kept all of their private keys in batches, and stored at different locations with people with different authority, it would have been 1. limited the damage potential of such a hack,and 2. make it much easier to work out who is likely at fault if there was an insider involved. Cryptopia also appear to either have not used a cold wallet whatsoever, or had somebody (probably multiple teams based worldwide) whose job it was to constantly sign transactions offline and then carry a USB key across to another computer to broadcast them. The first option is a harrowing possibility, and the second doesn't give me any further confidence given that they should have broken up their holdings into multiple smaller wallets in case of a breach (which wouldn't have helped them anyway because they were negligent with their private key management anyway).
Theories that cryptopia may have been involved themselves are probably fair allegations to make, given that this is a nasty bear market, and they're probably not making much, if anything over their fixed costs and 80-staff+ overheads. If a cryptopia management / insider was involved, they would have most likely got someone outside of the country to execute the hack.
Still, i'm looking forward to seeing the next update from the police, who while i'm not certain will catch the hacker, may divulge some of the reasons for fault.