Someone breached my server and stole a large amount of bitcoins. How can I find out who did this? Is there a way to check incoming connections? Is there a way to verify Vultr didn't do it?
It depends on your logging, on your machine. You should snapshot the machine immediately and get a forensic expert to look at it. . As a crime has been commited, I suggest you contact Vultr directly via a support ticket.
Have you reported it to law enforcement yet?