It’s easier to steal your own customers’ money than for someone to break in.

I don’t know if it’s exactly Occam’s Razor that “hacks” would originate from within the institutions compromised, but in crypto world the incentives are nuts and the ability to obfuscate bad behavior is extreme.