edit: Well regardless of that being the case, why would an attacker not withdraw all the funds they can lay their hands on?
Many people seem to believe the bitcoin-exchange-as-a-scam thing is worthwile, but I don't think it really is. Karpeles is in jail, and will be for a very long time, and I've heard he doesn't enjoy his jail time much.
The identities of these people are known, their spending can be tracked. I can't see how the life of a exchange scammer is in anyway more attractive than that of a straightforward exchange runner. What are they going to do, cash out a couple of million somewhere and emigrate to South America? They could do the same simply by selling their exchange. Besides, Dread Pirate Roberts showed that emigrating is not really attractive to many people, even when not doing so is a terrible idea.
https://news.bitcoin.com/inside-scoop-mark-karpeles-release/
How come so many people managed to trust BitFinex that appears to have such opaque management?
If it's an insider job by the founder, why did (s)he not withdraw 100% of the assets in the exchange? Probably to make it look more likely to be done by an outsider(s)?