What happens after a $250K crypto wallet drain if the funds keep moving?

Had a rough convo with a founder friend this week and now I’m kinda stuck thinking about it. Their company wallet got drained for a little over $250K, and the weird part is the funds didn’t just go to one wallet and sit there. They started splitting across new addresses, then some of it moved again within hours.
They have the transaction hashes, screenshots, wallet addresses, the usual stuff. But none of us really know what the next step is supposed to be when the funds are still moving.

Like… is this a legal issue first? The most stressful part is that everyone keeps saying “track the wallet,” but that doesn’t mean much when the funds are jumping around and nobody knows which wallet matters most anymore.

For anyone who has dealt with high-value crypto incidents from a cybersecurity side, what is the proper order of operations here?