edit: Well regardless of that being the case, why would an attacker not withdraw all the funds they can lay their hands on?
Many people seem to believe the bitcoin-exchange-as-a-scam thing is worthwile, but I don't think it really is. Karpeles is in jail, and will be for a very long time, and I've heard he doesn't enjoy his jail time much.
The identities of these people are known, their spending can be tracked. I can't see how the life of a exchange scammer is in anyway more attractive than that of a straightforward exchange runner. What are they going to do, cash out a couple of million somewhere and emigrate to South America? They could do the same simply by selling their exchange. Besides, Dread Pirate Roberts showed that emigrating is not really attractive to many people, even when not doing so is a terrible idea.