Here is a NiceHash hack transactions visualization:

They can keep track of the transactions until the hacker converts the Bitcoins to a more anonymous cc like Monero then it's pretty much over.