Even with KYC verification it's difficult to ensure that the real identity of the thief is used for the KYC procedure. No thief would reveal their true identity if their real purpose in the first place upon entering an exchange is to steal. It's easy for anyone to pass the KYC procedure without using their real identity.