I've just noticed something a little odd about that BTCServ transaction

The majority of "hacked" coins (419 BTC) got sent to 1E3PdhC1ARtxkDmq8LmYQeXqXNp2pSfQu3 which hasn't been spent. However the small amount sent to 1CrDpobPFbLvNtB2hnBtThu9qHJ2hpbwPz has been spent. The odd thing is both transactions got relayed by the ip
81.169.165.107 - which is BTCServe's ip.