It's not necessary that the first one to move them would be their hacker. It could be Satoshi if he felt there was justifiable danger.
I think if ALL early unhashed public keys are broken, then one could assume something like a quantum computer broke them. If only Satoshi's coins (or those thought to belong to him) move, then it's probably a normal move.
If this is an encrypted gift to support a friend through difficult times, it would not be a hack to decipher it and take the money. This message was sent voluntarily.