Your BTC2 for the masternode is supposed to be kept in a local wallet as per the setup guide, that means that you either set it up in an insecure manner or if your btc2 was actually in your local wallet, then the local wallet was compromised rather than the AWS one.