If Dropbox say there is no issue and there was no (serious) hack then it is far more credible having outside auditors substantiating the claim. I'd be more troubled if they didn't call in outside experts since Dropbox's existing people and processes are what allowed whatever attack it was to happen in the first place.

> What's troubling to me is Dropbox calling in outside auditors (experts). Means they really have no ideas what is happening. If it is a hack, it's damn good one.

Not necessarily. It's just that you might actually be blind to the problem if its your code so it's better to have a separate set of eyes looking at things.

Also, there might be problems in the code where you never imagined them - let alone the server setup which most probably are complex beasts in their own right...