there's always the risk that the defendant is judgement proof.
The money is literally waiting in a Bitcoin address.
innocent until proven guilty and i would imagine it is not easy to prove.
That's the real tricky part indeed. You'll either have to find the exploit in the source, or find many more victims who claim the same thing.