http://www.coindesk.com/sue-dao-hacker/
Others have suggested that the hacker can't be liable as they only did what the contract allowed. It's an interesting argument but, simply stated, code vulnerability doesn't equal consent.
As a defense, it’s pretty weak tea. Theft is theft, off chain or on.
In fact the hacker, if caught, would not only lose his gains, but be liable for the losses of many ETH owners. He is heading for bankruptcy and jailtime.
Assuming that we ignore the contract that the " hacker" agreed to which shows that he merely was a DAO client.
There is almost no chance the "hacker" will get caught. You understand that even if there was only 1 person shorting ETH , it is simply circumstantial evidence. In this case there may be several people they can believe to be suspects , and that is when they will hit a dead end.