Traced 3 deposits last year to Gox and found the coins are all there, only 2-3 TX away from my external send address.
Source: 1EbuCc81dratEh8j1z6uokYQWXhF3iNGMr Final: 1KJVoXikYWsdztn2zqfmRnc8b32xWBXuWV
Source: 13rK2ayxeLKpQyiJzVmwXYfBM2JmUvPGyf Final: 1HtZX7fUWiZckDx86yo1xqo3HJxXEoXJyV
Source: 1KqZmLEtYCSM6VqzXUzWpPJ4wxmwT7KHVg Final: 131TsvJdYveQNBHMS2K3Sv4QVWL4VYYsJz
In each case above, the 1st TX was from my external address to Gox's account specific address generated for each deposit. The 2nd hop should be to a concentrating address or an address in the hot wallet. The 3rd hop supposed to be an address in the cold wallet or the thief's address, perhaps?
But the strange thing is the coins didn't get move further from there. What kind of thief wouldn't do that?
Gox also seems to have conducted a major consolidation of their hot wallets on 12/31/2013 around 6:00 GMT. Perhaps a subsequent move to the cold storage went south but they failed to notice it before deleting those hot wallet keys?
I'm going to continue monitor those 3 final addresses to see if there is going to be any withdrawal from them in the future. It would be helpful if anyone can share more TX info from late Dec. so we can compare.