So who is the culprit based on the blockchain trail? If these are really stolen coins in the first place.
My guess would be the Craptsy account which owns these Dash addresses:
Xqi7sWthYKFPCK3KHcKq8BqY9vMcWy4r3t
XbwDPCTNhtodqqmRCYEAT2YTadJkeydQa5
XwceLMAKYDUgimYzvBMywRHFFmcegU9WUd
However, I don't have access to their account info, so they would need to track down the owner (I have already sent them this info)