The hacker is still moving XEM from account to account, and eventually into exchanges - primarily onto Bittrex. He probably has stolen identities and whatever else necessary to create the accounts. Pretty good sign that he hasn't been busted.
Last I checked there was 70mil XEM remaining in his last wallet, with ~30mil still in exchanges.
Hopefully he dumps it all sooner, rather than later. I think we are all ready for thought of him still having XEM to be over with.

I think it's best if we all look at the bright side of this, whether or not the hacker gets away.
1. He crashed price, giving us excellent buy opportunities.
2. Drew much attention to exchange security, resulting in actions to strengthen it.
3. One could claim he played a robin-hood role of sorts, redistributing tax (fees) to us lowly plebes.
4. Proved NEM blockchain tech. - A. It can't or won't be manipulated by a big boss or a government. B. It can be traced, even when laundered, and even by average joes like myself. C. NEM chain can securely handle large volumes of transactions even without Catapult implemented yet!