As someone else has already pointed out, they don't even have to pretend to get hacked to get to keep contributors' money. The model of dispensing 1% of balance per commit guarantees that it's impossible to get all of a project's contributions back out again.