For a guide to how this goes, see the Madoff recovery.[1] That took a long time, with payouts along the way. The big question was whether the amount owed was what customers had deposited with Madoff, or what customer's listed balances were with Madoff after years of fake gains. With the Madoff scam lasting decades, the fake yields were substantial. That was settled with a court decision that the amount deposited was what mattered. This controversy stalled payouts for some time.
Then, over the years, there were some big clawbacks, followed by distributions to victims. Many of the clawbacks involved people who were insiders in some sense, and they were deemed to have profited from the scam. The Madoff recovery got back about 75% of what people had put in. That's unusually good. Most of that was from clawbacks.
Madoff, though, was a regulated broker. The Security Investor Protection Act applied. Small investor losses (up to $500,000) were fully covered by SIPC insurance and paid out early. The SIPC ran the recovery process. There was an accelerated process for hardship cases. In crypto, there's none of that.
This clears up some questions I had before about employees potentially taking their own funds. Although, are customers in the clear here? As in, if you were a customer but were able to take your money out in time, is that money safe, or is some of it returned and then divided up?