the problem with defi hacks, from the perspective of the hacker, is you get a bunch of eth, which is a lot harder to hide and launder than BTC. As the saying goes, in crypto, your wallet is the bug bounty.
It is very easy these days to go between Eth <-> BTC without any KYC/AML.
Here's an old computerphile video: https://youtu.be/UlLN0QERWBs
Etherscan provides such a service for ethereum: https://info.etherscan.com/ethprotect/
As long as there are enough centralised services with enough volume that agree such tokens are tainted the decision is effectively made for the entire ecosystem.
Just as in real life getting someone to sign on the dotted line with the intent to cheat them is fraud that can invalidate the contractual obligation, technical exploitation of a smart contract is the same. As you say, it might not even be illegal, details matter, but it might also well be a felony.
Shapeshift just DROPPED its KYC.
https://erikvoorhees.medium.com/no-more-kyc-with-shapeshift-...
>Second, cross-chain exchanges may not be possible in a fully trustless manner.
Monero <-> Bitcoin atomic swaps (codename: farcaster) are coming later this year. In the mean time, you can use Bisq.
Actually it's quite easy with something like tornado.cash.