Re: Not your keys, not your crypto
They were probably getting ready to turn them into fiat, or had already turned some of it into fiat—hence the partial recovery. I'm surprised that the crims didn't immediately mix it ten ways from Sunday and convert it to other coins before trying to cash out. At least, that's what I would do. I'd also use Monero as an initial unit of exchange, since it's much harder to track.
Hold on, someone's knocking at my door.