I'm stunned that they had that much cryptocoin online to be stolen. Why didn't they put it in "cold storage" and only some information in the database which says how much each customer had?

OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.