the thief appears sloppy in how they stole the coins. multiple waves, linking outputs together etc.

Yep, also greedy. If he only emptied a few large wallets and sent them to different addresses each also not all at the same time the vulnerability may not have been discovered so quickly.

Most would have blamed the card holder as was seen in the initial few posts that showed up on reddit.

would be interesting to see what happens to them when they're found, shame we'll never know.