It's definitely possible it could have been an insider, but I think it probably wasn't this time. In this case, Occam's Razor suggests an outside job. Reasoni

It's definitely possible it could have been an insider, but I think it probably wasn't this time. In this case, Occam's Razor suggests an outside job. Reasoning: First, as carlosdp points out, insiders are the first suspect, everyone knows that now, and the FBI has advanced methods of finding them and recovering the funds. There's more deterence factor now. Second, hacking cloud infrastructure for industrial secrets and the like is so common these days, there are tons of black hat hackers and groups around the world that specialize in that. Third, the hack was simple once it was realized that the 5th of 9 signing keys was compromised by the whitelist. Combine that bit of information with #2 and it's essentially a guarantee that someone will make an attempt at it. Fourth, due to war in Ukraine, the world is in an elevated state of cyber warfare now. On top of the usual criminal hackers just looking to steal money, Russian and their allied hackers are seeking ways of stealing money to break sanctions, and/or disrupt financial systems in the West. All this just increases the odds the attack came from outside the org.