Great question. If the hacker were to cash out for fiat, he/she could easily be caught. I doubt this person is that stupid. If they transfer it to a crypto they can spend anywhere, using an anonymous coin, it'd be really difficult to track. Also, I'm sure they're spoofing their IP and running VPN's to make themselves untraceable.