Perhaps I don't understand Bitcoin well enough, but wouldn't these guys out themselves the instant they try and spend them because of the public transaction history?
It depends on how bitcoin flowed through their system. If funds flowed through a small number of addresses, the stolen bitcoin could have ended up in dozens of addresses that are difficult to distinguish from the seller addresses (short of enumerating the great majority of addresses used by sellers).
I'm surprised we haven't seen more theft and fraud with the tumblers. I used one out of curiosity about two years ago and the experience was basically to fill out a super shady looking webform, send the coins to the address it gives you, and then pray like hell that they come back out the other end.
The CoinJoin proposal[0] by Greg Maxwell provides transaction-history-tracing erasure capabilities. JoinMarket[1] is a market driven approach to incent CoinJoin mixing
It could also already be in cash.