If the server the masternode was hosted on was compromised and the 1k in the hot wallet, then there'd be no moving the node.
You'd must be holding the 1k vin on the same server who's running the daemon. Almost no one (if not on one) is doing it, cause it is extremely stupid. Can't prove it tho