It is also possible that insider is involved on the hack. In normal case exchanges will look for the addresses used in the hacking and will do everything to freeze it. Now, it has been days and yet the address used by hacker isn't frozen yet. Something is not right in here. I do not think it is the matter of security but I think it is a matter of who own that address.
Why is his wallets no frozen coinbase and usdt.
Stealing funds and buying eth. Weird! 😥
Seems like a weird decision for a hacker to buy ETH with his stolen funds. I mean i would probably buy stablecoins with it in this turbulent market. Also i don't think it is a very good move to buy Ethereum as a hacker because ETH can be pretty easily traced by the authorities, the policy and everyone else. So if he ever wants to cash those ETH out he will probably get caught i think. Maybe he just bought that ETH now to leave them untouched or to stake them for a few years and then in the futures when no one really thinks about that hack anymore he will start to move those funds again. I am sure though that a lot of people will continue to monitor this hacker even in a few years.
It is definitely weird so I guess it's just a matter of hour or day before that address holding the ETH is frozen.