Adding to other great answers, Trump uttered the sentence for the first time at the first Presidential debate on Sep. 26, 2016 in response to the following question:
Holt: We want to start with a 21st century war happening every day in this country. Our institutions are under cyber attack, and our secrets are being stolen. So my question is, who's behind it? And how do we fight it?
Trump: ...As far as the cyber, I agree to parts of what Secretary Clinton said. We should be better than anybody else, and perhaps we're not. I don't think anybody knows it was Russia that broke into the DNC. She's saying Russia, Russia, Russia, but I don't -- maybe it was. I mean, it could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds, OK?
"Somebody sitting on their bed that weighs 400 pounds" is a hyperbole used to emphasize the hacking could have been committed by anybody, not necessarily by Russia. It's very unlikely for people to weigh as much as 400 pounds (180 Kg).
The sentence could be rephrased to
Nobody knows who hacked the DNC as there is nothing to prove it. It could have been anybody including somebody weighing 400 pounds sitting on their bed. Are you sure it was Russia out of so many countries and individuals?
What does “someone sitting on their bed weighing 400 pounds” mean? Whom in particular is Mr. Trump referring to with this phrase?
It doesn't refer to any person. It just emphasizes the unlikelihood that people would know for sure who did it. In addition, he wants to convey the message it doesn't take Russia's sophisticated technology to hack the DNC and anybody can do it.