Clarification - I believe I wrote victims would have to buy BTC, not the hackers. So we can agree on that :)
Re: addresses, I was referring to the addresses the hackers asked the btc to be sent to. I suppose these are only known if they were reported, so you are right we probably do not know them all.
We will have to agree to disagree though because at the end of the day, it is still a matter of opinion as we are both assuming we know what did the hackers with the funds.
We can logically assume (yes, this is not proof) that the ransom was in BTC, because it's the hardest to track and the easiest to launder, especially by coin mixing services and through unregulated exchanges, neither of which require user IDs.
What would the hackers do with the funds? Try to get them, at the end :)
Very true. But I wouldn't assume they'd be in any rush altogether :) Followed!