<…>
That is likely technically going to be considered as stealing, since you’d be moving it without her consent and through her credentials. That is something for you to figure out though.
Besides the IP, the Exchange may save other information one is not aware of (i.e. browser, version, screen size, OS, and so forth). Those likely will not allow you to be pinpointed though on their own, but are rathermore complements.
VPNs may retain logs over a certain period of time, and law enforcement may require pertinent data to be revealed. That will, of course, depend on multiple factors, but it’s
not a definite "no, you won’t get tracked".
What will probably be more revealing is that Exchanges tend to have KYC in place increasingly, so the "hacked" Exchange can simply investigate the real on-chain TX, and alongside the recipient's Exchange, derive de ID of the "hacker" (off-chain-> on-chain-> off-chain; or off-chain -> off-chain if it's the same Exchange).