He said it was not a hot wallet. He said no keys were online. So somehow his process was compromised.

The guy is extremely strange and almost unable to communicate. He probably did something very weird with his cold wallet private key.