It was definitely done by an Ethereum insider, even the ethereum developers admit to that, as the technical expertise required to execute that hack is only possessed by a short list of developers in ethereum, but no one knows which person or group did the hack, maybe one day that info will come out.