If they made a transaction with the exact amount stolen, maybe we could say it is the same wallet as the one stolen, but it could also be a false positive.

I would think the thieves are smart enough to make multiple transactions to move this money, in which case they won't get caught at all.

Yes and no. While all transactions are public, you can use a "mixing service" that will mix your Bitcoins with other people's Bitcoins, effectively covering their origin.