What does “Someone sitting on their bed weighing 400 pounds” mean?

The New York Times’ article (December 31, 2016) that came under the title, “Trump promises a revelation on hacking” ends up with the following paragraph:

Mr. Trump, who has sought a warmer relationship with Mr. Putin, has repeatedly scoffed at the notion that Russia was behind the hacking, a stance at odds with members of his own party. At one point, Mr. Trump declared that the hacking may have been the work of “someone sitting on their bed weighing 400 pounds.”

What does “someone sitting on their bed weighing 400 pounds” mean? Whom in particular is Mr. Trump referring to with this phrase?

There is sometimes a stereotype of gamer/hacker/computer-savvy people that they just sit at their computers all day playing their games/hacking/doing computer things and so end up fat and gross. Needless to say, it's not that accurate..

The television show South Park hits on this in an episode where the characters get so involved in a computer game that they are shown to have gained hundreds of pounds and do nothing but sit behind their computer playing the video game all day.

Trump is downplaying the entity or persons that was behind the hacking, making it seem like it was not a sophisticated government-backed institution that was behind this, but instead just some person living in their mom's basement who does nothing but eat, gain weight, and do things on the computer.

To have people around you say that a government such as Russia was behind the hacking and then respond saying that it may have been someone lying on their bed weighing 400 pounds, is–to me–either an attempt to downplay the severity of the situation should Russia really be behind it, or an attempt at saying that there has been a lack of public evidence that points to Russia as being responsible and so we don't know who is behind the attack. For all we know it could be any unsophisticated person... including someone weighing 400 pounds sitting on their bed not backed by a government.

Grammatically the sentence is ambiguous. "Weighing 400 pounds" is an adjectival phrase that can modify the man, or the bed, since there are few formal rules on word placement in English. It could mean the man weighs 400 pounds, or that the bed weighs 400 pounds. (A 400 pound man would be very obese.)

Though it could technically mean that the bed itself weighed 400 pounds, knowing Donald Trump, it is clear that he meant, "We don't know that the Russians did this, it might have been a fat guy in his bed."

There have been factual cases in the U.S. and U.K. of people who have become invalids due to becoming so obese (several hundred pounds) that they can no longer lift themselves up, becoming trapped in a bed, chair, or other piece of furniture.

Some news stories (warning: unpleasant and graphic):

• U.K. man, 900 pounds, trapped in bed: http://www.huffingtonpost.co.uk/2015/07/27/channel-5-carl-thompson-65-stone-and-trapped-in-my-house_n_7877420.html
• U.S. woman, 700 pounds, trapped in bed: http://abcnews.go.com/Health/video/697-pound-woman-trapped-bed-10990414
• U.S. man, "morbidly obese", fused to chair: http://www.foxnews.com/health/2011/03/29/obese-ohio-man-fused-chair-sat-2-years.html

Since this isn't any kind of standard idiom, it's unclear what Trump meant by it. Perhaps the implication is that the person is isolated and not connected to any social group or nation whatsoever. Or the implication could be that this only happens to people in the wealthy U.S./U.K., and not other nationalities. Or it could be meant to indicate that the hacking is due to someone being bored and not a truly malicious actor.

Adding to other great answers, Trump uttered the sentence for the first time at the first Presidential debate on Sep. 26, 2016 in response to the following question:

Holt: We want to start with a 21st century war happening every day in this country. Our institutions are under cyber attack, and our secrets are being stolen. So my question is, who's behind it? And how do we fight it?

Trump: ...As far as the cyber, I agree to parts of what Secretary Clinton said. We should be better than anybody else, and perhaps we're not. I don't think anybody knows it was Russia that broke into the DNC. She's saying Russia, Russia, Russia, but I don't -- maybe it was. I mean, it could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds, OK?

"Somebody sitting on their bed that weighs 400 pounds" is a hyperbole used to emphasize the hacking could have been committed by anybody, not necessarily by Russia. It's very unlikely for people to weigh as much as 400 pounds (180 Kg).

The sentence could be rephrased to

Nobody knows who hacked the DNC as there is nothing to prove it. It could have been anybody including somebody weighing 400 pounds sitting on their bed. Are you sure it was Russia out of so many countries and individuals?

Your question:

What does “someone sitting on their bed weighing 400 pounds” mean? Whom in particular is Mr. Trump referring to with this phrase?

It doesn't refer to any person. It just emphasizes the unlikelihood that people would know for sure who did it. In addition, he wants to convey the message it doesn't take Russia's sophisticated technology to hack the DNC and anybody can do it.