There are ways for those people to cash out without filling any KYC procedures like passport identification.
For example trading them for cash face to face under spot value to find buyers fast, in a location with no CC cameras.
They could also use btc mixers to obfuscate the coins.
In short, that money is permanently lost unless the thieves are exceptionally stupid and try to cash in at legal traders.
Theoretically you're right but the most could be caught becasue they do mistakes. They split the amount and move it around for obfuscation. They use mixers, exchange in monero forth and back etc. Successfull scammers have to manage a lot of addresses after a while and then earlier or later they start co-spending some of them. Even if they do it 500 times right one little mistake (co-spending a coin after mixing with coins before mixing) then the house of cards collapse. As said by far the most do earlier or later a mistake and then it's written in stone and cannot be taken out of the blockchain anymore. The reason why the police isn't catching them is because many people don't try it (under the assumption that it's not posssible) and because the police has not enough specialists to follow up.
Btw with mixers. I did recently a check of a Coinjoin Wasabi mixer transaction where people were very carefully and mixed the coins three times in a row. Neverthless I could link more than 20% of the mixers output addresses with the inputs because the users did the mistake to co-spend mixed coins with other coins. 20% might sound not very promising but if you take into account that a person with 500 transaction can be caught if only one transaction was not carefully enough then it's a number where scammers should start sleeping bad. Even after years all evidences are available in the blockchain and the analytics software (from us btctester or from forensicsone or chainalysis or others) are getting better and better.
The brain of a scammer might think two or three steps but the analytics software use sophisticated heuristics to find all addresses of the scammer and follows all paths of these addresses to see when it goes to an exchange. Mostly there are paths to exchanges because the scammers don't want to go with a hugh amount to an exchange.
I conclude that our police simply do not have enough experts to follow up on something like this.
And that's why Chainalysis is trying to take over the space of forensic blockchain analysis. I have nothing against using their methods to catch criminals and whatnot, but it appears that some of their 'investigations' aren't really connected into some criminal activities. They literally peer into any transaction that they find interesting and connect all the dots, somehow lessening the anonymity of those people involved in the said transaction. Police intelligence divisions aren't really well versed in the said area just yet, but contracting Chainalysis and other blockchain analysis companies for forensic analyses of crimes involving cryptocurrencies isn't really good either.
It's all about likelihoods. So the analytics result is never 100% true, it might be 99% likely. And therefore many people will need analytics. E.g. if chainalysis sells their reports to the tax authorities and the tax authority comes to you accusing that you didn't pay all your bitcoin tax then you need to defense yourself if it's not true or only partly true. Then you need as well an expert statement saying the mentioned transactions could be have another meaning because it could be a payjoin transaction and the judge finally has to decide whether or not he'll deide against you if it's only 90% likely that the chainalysis report is saying the truth. The same could happen in criminal cases. I saw a lot of rubbish from analytics.
This is where the scammer collected the funds finallly:
https://www.blockchain.com/btc/address/1JsACYBoRCYkz7DSgyKurMyibbmHwcHbPd.
The 1GYNGZ... address he used successfully with about 10 victims but there are thousands others all ending up in the 1JsAC.... in total more than 4000 BTC. The scammer followed Satoshis advice not to use always the same address a bit.
[moderator's note: consecutive posts merged]