the first step is for sure they will find the cause of the damage or weakness of the hacked system, and as much as possible they will look for the perpetrator.
but that is very unlikely, the system that runs on bitcoin and crypto is very different from the usual internet system, and makes it difficult to find out if there is a hack.