this "hacker" didn't want to spend that time in it, he/she did it voluntarily, maybe he/she isn't even friend with hive, can also be the last minute thought, did what he/she thought right with the lowest effort
current few witnesses on steem can do anything atm, 24 hr in advance can be skipped too.
sending to bittrex wasn't the most smart move, my first thought was the hacker could be bittrex themselves lol
But pushing out a soft fork to freeze those accounts to 20 sock puppet witnesses would only take a matter of minutes.
The exchanges are closed. Duh.