I don't think we could say they walked away yet. Cashing that money is going to be much harder than the hack itself imo. They might have already compromised themselves if any of their interactions with the contract, including past interactions when they were still experimenting with the exploit, was not properly annonymized (used tor + vpns + public internet Hotspot).

There are a few companies that specialize in tracking blockchain hackers. Not to mention law enforcement.