The amount varied over time, but was hundreds of BTC. I used it as collateral when accepting inputs.io deposits. I only credited inputs.io deposits to JD up to the amount TF had on deposit at any time. I regularly withdrew from the JD inputs account to a 'real' wallet.
The timeline as I understand it went something like this:
* late October, the inputs server was compromised, the database was stolen, and 4000 BTC was taken from the hot wallet
* inputs.io carried on operating as normal, still accepting new deposits, with 4000 BTC missing from its wallet
* for a couple of days after the theft, I was unable to withdraw from inputs.io to the blockchain. the "hot pocket" was empty. I emailed several times, and eventually after about 48h was able to withdraw. At no point was I told that the server had been hacked
* a couple of weeks later the hacker used stolen API keys to steal ~100 BTC from user accounts, including ~42 BTC from the JD account
* an hour after that theft I woke up, saw the withdrawal, moved all the coins I had access to into cold storage as a precaution, stopped accepting inputs.io as a deposit method
* later that day TF came to the JD chat and asked for his deposit (less the 42 BTC he owed JD) back.
* I debited his account the ~42 BTC, then unblocked his account from withdrawing. He withdrew the rest of the balance
* I asked him if he would be redepositing so that we could start accepting inputs deposits again. He said he definitely would.
* a day or so later the inputs front page was edited to say that 4100 BTC had been stolen.
The moral of the story seems to be "don't trust third parties with your Bitcoins". A lesson that lots of investors seem to be learning. Investment in JD is down ~5k to around 57k BTC since the inputs hack became public. I don't know whether this is mostly due to people cashing out BTC due to the recent price rises, or people wanting the security of holding their own coins. I guess it's some of each.
i see! hmmm