I don't think it was insider job. If insiders wanted to steal people's assets why do it in such a public manner? If they have the keys they can just move funds discretely from the larger pooled assets without draining individual accounts. A malicious app update draws way too much undue attention.
If I were an insider, I'd want to steal the funds out in the open and add decoys such as the app update to make it look like a hack.