Reading some of the press about it, it seems the victim at least is convinced that it was because of a data leak. Probably Coinbase. Much easier than trying to Dox someone from limited public social media posts, is an authoritative source of "X person owns Y BTC, here's their address"