The scammer is using a part of the stolen ETH, to buy BAT tokens.

https://etherscan.io/address/0x3feedd6a7028dd56dc0bd5f260371161eaf06341

And then this shuffle goes on:

https://etherscan.io/address/0x9ea44cbec4fa9069af5235dac8b3a05e0891ab95

https://etherscan.io/address/0x4e005aa5cd466d30f90df15fde80592163291f11

https://etherscan.io/address/0x9ae9642a9b4fad11d7b815a6176636fd96fc651a --> 0,2 ETH For Contract creation written by Bitrex, to create wallets

https://etherscan.io/address/0xdbda8173ff0220ce3b533725e0875a937761ed0b