maybe we can found the source code of the hack, maybe it was on the server of vitalik.ca
Why els he transfer from the hotwallet from the Foundation wallet to his private wallet? he transfer 125.000 ETH. on 30 juli 2016
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Please approve my operation
2cb2aa660dfae4f3b16472c3cab83ec0f606a1045ef5c01db77f75459393cf62
ie. send a transaction with data
797af6272cb2aa660dfae4f3b16472c3cab83ec0f606a1045ef5c01db77f75459393cf62
in order to split 125000 ETC, sending the ETH back to the foundation wallet and the ETC to my hot wallet at:
https://etherchain.org/account/0xf406ba0fba012777ae54630b31ff4847c00c6c10-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBAgAGBQJXn1h0AAoJEKmdCCphefmHWqQMAJ/OxCh1THZgeBjx0xP/sxi4
JGzu74NUQCxZP0AdD6TowmdlE/OJuvCE3ZZLZoXsNkVeFKhZtJTyhKXOiupu6wiL
OqhLCW8UiGsH8p+3CRqsuk8BtsJEfDIaYvorKDxAUTBX6zuKKVSWsOl1VBvqVKCe
+jQkb6lCstn8jZwH+srN2Dh50iZbv396V1Cjr4CL5dWVZIiM9qShB6G+88J2cmbp
g/5+2tKfKnP3bLEW74aT5goS8v1CLLz92+OmLeeBycHXx+P94W5L0BO9jZeeO4F9
IMgj6jJ2Jsm9YQ1Gvgf6oxpV8ZqAZJcAyAvSVPsWDwbQGN0yCQwRVGNfdXezAZZq
wfduCfGjTE0mGft8DAkmBpeNCtrg5UqPRUPHIY7RHtGQe/vtZKmMZFoNmOMttvEh
jJIR/fgRv/xEREwhPBUzHPz7/24X9CFL94dsHWCRN5/eXD7vRE7yokuhXUjDQlC3
zWc/0pmYDWtuwbcHpsixc5yAD3YV64MjumrjHJ+iAw==
=D4yI
-----END PGP SIGNATURE-----