Thanks for all the additional information, it does seem highly unusual that someone would go through all that manual obfuscation only to link his final spend into an exchange (Binance, for that matter) with unspent outputs from the original. Suppose no one's immune from noob mistakes, probably did a sweep from the wrong wallet.
Albeit a "dent" in anyone's life, it seems that the attack "only" represents about 6 % of the company's total assets[1]:
Still a significant hit, given how many big corporations stutter if they just lose one month of output. Fine margins. But I guess Binance would be happy to play hero and return this all to Exmo.