In the twitter thread the OP links to.
https://twitter.com/LukeDashjr/status/1609683917644120067
You can easily browse through his recent tweets here https://twitter.com/LukeDashjr/with_replies
Thanks, added a correction.
Yeah, my best guess is that he was owned for a while and the hackers managed to pivot into everything owns. The plan was probably to backdoor bitcoin core, but after luke-jr detected his server being compromised the hackers figured they were burned and decided to run off with whatever bitcoin they could get from him.
edit:
if you're talking about https://twitter.com/LukeDashjr/status/1609661811455819776, my guess is that he's either omitting something (eg. the cold wallet was internet connected, or there was a backup of its wallet floating around somewhere), or suffered a stuxnet level attack.