[panarky]

  “Cold storage” does not “leak”. The idea that the funds were stolen,
  unnoticed, from cold storage, due to Transaction Malleability,
  strains the credulity of even the most gullible observers.

This part of the story still doesn't make sense.

One possible explanation that I haven't seen anywhere else is that MtGox lost control of the private keys to their cold storage.

How else could 744,000 BTC disappear, without anyone noticing, from cold storage?