Well yes, that portion is correct. Rereading, I realized I left a portion out and I apologize. Let me try this again...

I mentioned that new wallets were downloaded and not fully synced, and the employee moving funds just used the new addresses to transfer funds as quickly as possible in an attempt to move the funds before the thieves could. Because of this and the speed it was completed, there were no confirmations of the coins in the new wallets. Fast-forward several months, we are trying to turn these safe wallets back on and several do not connect because either nodes have changed, wallets have been updated and we are trying to run an outdated wallet, etc. Because of this, many of the new (safe) wallets are reporting a 0.0 balance (the wallets are command line based and do not have a GUI which would show an unconfirmed balance). In order to see a true balance, we need to fully sync the blockchains to determine if we were successful in moving the coins to our wallets before the thieves moved the coins to theirs. The task at hand is determining whether; 1) a coin has a wallet update &/or fork which is why we cannot get any connections; 2) nodes have changed and the nodes listed in different coins' ANN threads are no longer relevant; or 3) the coin is truly "dead" and no active nodes exist, which could be why we get no connections.

I hope that clears up the issues I have been facing. As it stands, probably close to half of the coins report a 0 balance so I am unable to determine whether the coins are gone or just sitting in a wallet that cannot connect to a network. Also, because of the nature of the 2 hacks that were occurring it became frantic fairly quickly which led to the site shutting down last April. One hacker had been slowly leeching coins out of wallets unsuspected. As soon as he realized there was another hacker taking out chunks at a time, it became a race between each of the hackers and CR staff (at the time) to move funds to their respective wallets as quickly as possible.