> OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.

You’re misunderstanding where these coins were taken from/are now. Of course they did not get access to customer private keys, because in an exchange there isn’t really such a thing. You’re trusting the exchange to hold the coins for you, and they get put into a shared wallet that they manage with the exchange’s key.

Even if they did not have access to the exchange’s private keys and only got access to some API that let them execute the transfers, it doesn’t matter anyway, as the attackers transferred the coins into new addresses with keys controlled by them, so they’re free to move them now.

…well, mostly, the stolen USDC and USDT coins got frozen by the issuers, but those are not really decentralized as much as they are built on top of decentralized infrastructure.