The majority of "hacked" coins (419 BTC) got sent to 1E3PdhC1ARtxkDmq8LmYQeXqXNp2pSfQu3 which hasn't been spent. However the small amount sent to 1CrDpobPFbLvNtB2hnBtThu9qHJ2hpbwPz has been spent. The odd thing is both transactions got relayed by the ip
81.169.165.107 - which is BTCServe's ip.
So, that means the hacker either is close topologically by default or has added manually BTCServ IP as a peer? If the hacker is manually relaying thru BTCServ that's a bit like rubbing salt in a wound! Or another interpretation is that it's still controlled by BTCServ, though obviously not provably.
Funny, when I saw the 1Cr... address it tweaked my memory and I thought it was the current BitLotto address but I was wrong - that's similar but different.