The hacker will have a rough time converting these to USD without exposing himself. If they’re in Russia they probably don’t need to care, but there’s a reasonable chance they live in a country that the FBI can reach.
On the other hand, no one can do anything until the coins are moved or more information is uncovered. What a nightmare to lose $3.6m overnight.