"How well do you know your team?" That's the big question and probably one of the important aspects of a hacking case. People form teams from different parts of the world with different professions so obviously, you can only know them through their online profiles (thanks to LinkedIn) but you don't actually know the motives of these People and how trusted they are.
My point is, perhaps this is an inside job.

Am not a tech person but I understand that the best way is changing the smart contract address to render the stolen tokens useless or ask the dex for help by stopping trading so they can trace and block that address assuming this only trading in this dex.