Don't forget the 500,000 BTC he took in 2011 while blaming it on a hacker. Go dig up the details on that one. I've summarized it already elsewhere, but lemme try again. The first users of Mt. Gox didn't have salted passwords. Salted passwords make it nearly impossible to brute-force a password if you have the encrypted version of the password in front of you -- such as in a password file. They SHOULD have reset their passwords as soon as GOX implemented the salting code. But many of them didn't.
Who better than Karpeles would know how to exploit this? All he had to do was scoop the coins out of those accounts, and release the password file into the wild for plausible deniability. The PROOF would be in the sheer % of those unsalted accounts that were cleaned out. Why? Because even with the password file, the supposed 'hacker' would have STILL needed to brute-force EACH ONE of those passwords. And there was nowhere near the time to do that for that number of accounts. I'll bet you they were ALL emptied out, or he left the ones alone with like less than $0.50 in them - again, for plausible deniability.
