There is another way around if the attacker does some silly mistakes, if the attacker somehow identifies one of his wallet and even though he is using a proxy and he is using the social media accounts using the same proxy, then he is traceable and for that to happen he needs to do a series of blunders.
The ransomware coins cannot be used, if they move the coins to other exchanges it will be confiscated, it was just a dumb move by the hackers.