How would an attacker exploit a service while it was inaccessible because they're DDoSing it? Why would someone draw attention to themselves like that?
Maybe the attacker stole the coins and then DDoS'd the site?
It's all speculation, we're pretty light on details, but the whole DDoS-as-a-distraction thing seems a little out there to me.
