It's difficult to prove but not impossible. Whoever did it accessed their systems somehow, and they would have left a trace somewhere. If they try to cash out all at once they'l be caught easy as they can't explain where it came from. Their only chance if they did everything else right is to never use exchanges with passport registry. Just stick to changing the Nem to Bitcoin and then selling the Bitcoin cash in hand in person. This would take time depending on what type of customers they have but there seems to be no shortage of people who want Bitcoin. This gives the term bank robbery a whole new meaning. Security should be the #1priority of any financial service provider. These kinds of occurrences will be part of the arguments for regulation and you know what maybe it's high time.