[EVa5I7bHFq9mnYK]

That's just author's speculation. Most probably he did conduct the hack himself, because he had private keys to all the original withdrawal addresses.