Okay, so there's all this KYC on every exchange, and we all submit proof of our existence, isn't this something that one would use when something like this happens?

The address that sent the money to the address that withdrew the funds from the ICO is:  0xb9e924bD912325d3a4d44C3035382B3763184CCD which got a deposit from Bittrex.

Or is the KYC only for anti-pot money?