Which is the same as 2) and 3).

No, could have been stolen through bugs in their software (e.g. transaction maleability), not directly from stealing the keys

that is #2

not exactly the same, one bad actor owning that amount of bitcoins would be scary: for example, this person could first trade otc one fraction after mixing, second talk with some entity that hates bitcoin (say jpmorgan) and tell them that you can sell the rest in the open market (on every big exchange) sending the price to 0 (literally), get profits and powerful new friends from doing this.

The situation doesn't looks good.