Almost entire balance (2675 XMR) of Community Crowdfunding System (CCS) Monero wallet has been stolen
Seconded.
With only 2 known keyholders and likely 1 single person with physical access to the Qubes laptop, and where the whole key and wallet were probably stored in a standalone offline vault-vm, what the fuck happened?
As pointed out in the github thread by someone, the more useful opsec flow should have gone something like this.
And make the offline computer an offline vault-vm on a non-internet Qubes laptop .