We don't know if all four million dollars were deposited to centralized exchanges or not. Since they used two centralized exchanges, they could have used some other decentralized exchanges as well. We don't know what steps Meta Win has taken so far. They may get the funds back if they can reach the correct department. But I am sure that they won't get the whole four million.

If they deposit all four million in exchanges, they can recover most of it. But if the hackers moved the funds somewhere else, they would probably be lost. At first, I thought they would know their identity since the funds ended up in CEX. But later, I came to realize that hackers usually use bought/fake exchange accounts.