Recovering a stolen fund is dependent on many factors. If the address is used only once and then moved to an exchange where it is traded for fiat then it will be impossible for any forensic expert to do any recovery but as long as it keeps moving across addresses the behaviour of those transactions can be studied and assumptions can be made. But this process requires time and even more of what was lost to the hackers