They might very well be in possession of the 950k but have lost the private key to spend those funds. It looks like in recent days they regained control of 200k BTC, so perhaps they've recovered a key or two?
I sure wish they would make a statement soon because if it was in fact the case that they recovered a large portion of their BTC, that would go a long way to bolstering faith in BitCoin itself, whose brand they totally damaged by blaming transaction malleability in the first place.
Not specifically - perhaps because saying they were stolen is slightly (but only slightly) less embarrassing than saying they misplaced the key.
Karpeles did say something to the effect that the funds were "temporarily unavailable" - which would be consistent with losing the key, if they had any hope of getting it back.
The attack that they claim happened was due to a bug in their accounting software. The software sometimes wouldn't record that a transaction had finished, so that account's balance didn't go down. Nothing to do with losing keys.
Karpeles was trying to get investors to cover the losses after the bug was found. That's why he was hoping the losses would be temporary. But Mt Gox's business practices are so bad no one wanted to invest in them, so that's almost certainly not going to happen.
There is only one way the coins could be recovered: if the thieves are found with the stash intact. Just keep in mind that Karpeles might be the thief.
Last week people had tracked down Gox's prior BTC transactions and they still had the coins in an address they controlled.
I've theorized that they lost the key, not because of any direct evidence, but because it's the only thing that makes a little bit of sense without out-and-out fraud.
I sure wish they would make a statement soon because if it was in fact the case that they recovered a large portion of their BTC, that would go a long way to bolstering faith in BitCoin itself, whose brand they totally damaged by blaming transaction malleability in the first place.