Where was this posted? Can you post a link?
edit:
if you're talking about https://twitter.com/LukeDashjr/status/1609661811455819776, my guess is that he's either omitting something (eg. the cold wallet was internet connected, or there was a backup of its wallet floating around somewhere), or suffered a stuxnet level attack.
In the twitter thread the OP links to.
https://twitter.com/LukeDashjr/status/1609683917644120067
You can easily browse through his recent tweets here https://twitter.com/LukeDashjr/with_replies
Thanks, added a correction.
Yeah, my best guess is that he was owned for a while and the hackers managed to pivot into everything owns. The plan was probably to backdoor bitcoin core, but after luke-jr detected his server being compromised the hackers figured they were burned and decided to run off with whatever bitcoin they could get from him.
Luke has specifically denied this (before you posted your comment)