Also, looking at reddit, they moved to a new datacenter recently. So could be that a datacenter employee stole code and database and then submitted the withdrawal requests from the stolen code to Bitgo. Not even sure how to protect against that.