During one WAN show they did mention moving away from LastPass and Linus himself has accidentally revealed private information on streams by being logged in to the wrong account multiple times now.

However, for all we know there's a 0day in some part of the YouTube system. Maybe some (sponsored) device got hooked up to the internal network and laid dormant for a while.

I think one of the staff logged into the primary YouTube account got phished but there are so many ways this could've happened. Luckily for them, their channel is large enough that I think they'll make a full recovery once they've found out how this could have happened.