I don't think that's correct. If you only revert the stolen money transactions and all the branches of them since, almost nobody loses. The few stolen ETH that got sold will be a loss, but it's nothing compared to $35M.
It's a hard fork. The contract would be fixed. But you could also send the victim's money anywhere, just ask the victim where they want it, there are only 3 major ones.