They're public, but also anonymous. It's designed to be difficult to tie a bitcoin address to a specific person or business. You can see all of the addresses that the stolen bitcoins went through, but proving that a specific person was behind the theft is hard. Especially if the thief takes a few precautions - sending through a few different anonymous wallet sites, etc.