Cold wallet, but keys encrypted and stored in digital format, most likely. This is the kind of fuck-up that’s going to be exploited by politicians to try to criminalize private key ownership outside of licensed financial institutions. If someone supposedly so technologically skilled can get hacked this way, what hope is there for the masses?