I'm guessing they brute forced into his laptop (or used a windows exploit or something) and opened up the program to find the cold wallet addresses (which is am

I'm guessing they brute forced into his laptop (or used a windows exploit or something) and opened up the program to find the cold wallet addresses (which is amazing they didn't have elsewhere) and then found them to be empty. Even if they didn't have the private keys, they'd just need the address to discover the balance. Though, the keys were also probably on the laptop.