It would be interesting to put these transactions, or the whole blockchain, in a graph database like Neo4J. Dealing with it as a graph would make it easier to find the sinks for all the transactions that started from that wallet. It would also be interesting to look at deviations from the historical statistical distribution in the aggregate of these transactions as a function of time, that would show when a single actor moved a lot of bitcoins even if it is allocated among many addresses. I would bet that the thieves didn't bother to match their transactions with the background statistical distribution.