At no point was the ETH in the attacker's hands. Most of the ETH was trapped in a stalemate between the attackers (white-hats and black-hats), the remainder was time-locked under the Dao's control until the fork.
Also, the complete history of TheDAO is still on the mainchain and is being replayed and re-validated each time you do a fresh sync.