How do they know 1.6 million have been stolen?
From the on-chain data, written in the article on the mirror platform attached by the OP, the author says that out of a total of 94 unique addresses that have been traced, the total stolen funds are around $1.6M. FYI, the attacker has also spent around $25K (46$BNB and 9$ETH) to carry out this action, this is a new phenomenon in crypto, so be careful if you have a lot of money stored in crypto.