It's possible that they used a terminal with a cash drawer that is set to open for cash payments when closing some checks that paid cash, if they do that it will go into the drawer and not into hand. This would make the drawer off as well though, did you have any issue there? You should be able to see if this was the case by looking at the cash activity audit or cash drawer history, look for cash payments from employees that should not be there.
