Here's the detailed report on how the funds were stolen from Mt.Gox: http://blog.wizsec.jp/2017/07/breaking-open-mtgox-1.html

To be clear, this investigation turned up evidence to identify Vinnik not as a hacker/thief but as a money launderer; his arrest news also suggests this is what he is being suspected for. He may have merely bought cheap coins from thieves and offered a laundering service.