I love Coinbase's stance on this. Everybody (customers) are whole. Somebody knows a few of these bad actors. Imagine the temptation to be offered 20 Million to turn in the bad actors even if they are family or friends. I don't know if I could trust my very best friend with my well being if they could get 20 Million for turning me in for a crime. I doubt it will be too long before the domino trail falls.
Coinbase managed it pretty well so far: informing their customers, detecting and firing the personnel involved and putting pressure on the criminals with the bounty on their head. It also sends a message to any one who tries to mess with them. Looks like they came prepared !
Yes, but should the info get sold on the dark web bad folks will know that John Smith lives at 123 Main Street and he has BTC. That won't go away.