Market surveillance is much better than most people realize. The accounts making money on a scam like this would be identified, filtered for anomalous activity, and the people at the other end investigated.

They might be, but the money nevertheless is pretty clean (has an acceptable origin).

The way around this is to leave no traces of the hack or to cash in using another person.