My speculations:

• "insecure from the start" - as in , the wallet was never that "cold"

• with that amount of money, it's easy to imagine an "insider threat"

• the hackers could have gotten lucky and struck right when the company was doing legitimate operations on the wallet

• but probably it's a towering mountain of incompetence, composed of the elements above and more