First of all, the theft happened on the blockchain.

However, Justin Sun being the tech degenerate he is, must've trusted the creation of the steem account community321 (the account set to receive the stolen funds) to someone else.
And that someone immediately transferred the stolen STEEM to Bittrex

Source: https://eternal.dragonchain.com/transaction/88c71cb3-90e5-41e3-b831-8d7a30c66c25

community321 transfer 23,627,501 STEEM to bittrex These are funds stolen by the Steem witnesses using HF23 May 20th 2020 - please return them to their original owners prior to the fork :)

Check Steemd: https://steemd.com/@community321

So uh... Criminal got scammed of stolen funds literally seconds after the act.