With the hot wallets being swapped and only 200 something K being moved it has seemed to me sense the beginning that the wallets got hacked and swapped out, so those funds that are being moved are stolen.
HuggyBuggy also made it known they have been exploited for funds before and made it right, so they could do the same again.