The fact that they are faceless makes it absolutely impossible to catch them, and also kind of impossible to recover stolen funds from them - they are very professional (if I should use that word).
Such an amount stolen in coins can't be recovered just easily as you guys thinks, even the one that was sent to centralised excahges, may have hard time being recovered because some of the policies of those centralised excahges cover's the protection of users right as regards to deposites, so not just that easy, there must be legal procedures and court orders for such accounts to be frozen.
So metawin have alot of hard work to do, in trying to recover theo stolen $4million, because majority's of that transactions where sent to personal Wallets which could be very hard to track.
You are right, an exchange plaform can not just freeze the funds on an account if they are yet to either get a full verification of where the fund came from, and even at this, one will still have to obtain a court order to effect the freeze.
I remember vividly one time that I mistakenly transfered money to the wrong bank account using my local bank account banking app here in my country, I went to the bank to complain about the errorneuos transfer and to see how the fund can be reversed back to my account, the bank said that they can not reverse the payment since they not allowed to take money out of someones account without their consent, they told me they would freeze the funds, and then ask the consent of the account owner before they can reverse the money back to my account, they also told me that before they can freeze the fund, I have to get a court order first, the process was very long and by the end of the day, I was not able to recover that money back even after obtaining the court order and the claiming they had freezed the fund.
I believe this is how online exchanges operate too, if Metawin will be willing to want to try to recover their lost money back, they will have to start by involving the court, and then working closely with the exchange where the hacker deposited the funds, this is if the hacker have not withdrawn the money and then abandoned the exchange platform.