Unless the address in question was an Exchange deposit address. In that case hacker has purchased $30mm worth of Bitcoins in a matter of hours and moved them out immediately without needing to move Tether anywhere.

There was already a BTC price spike on Nov 19.

This change was from 14 hours ago: https://github.com/tetherto/omnicore/pull/1

Couldn't you just try to find exchanges where Tether volume spiked around that time?

Thanks for the link, very useful for those of us who don't really know what to do with addresses posted in these stories.