They can certainly cash it out using a number of bitcoin to currency services. So the hacker has done the equivalent of stealing $1mil out of a bank, except a bank is very easy to trace while stealing BTC means the thief is home free.
https://www.bitcoin.de/en?cr=1
https://www.bitstamp.net/
https://btc-e.com/
https://www.bitfinex.com/
https://localbitcoins.com/