Since transactions can be followed, should finding the perpetrator be fairly easy??
Cryptocurrencies (most of them) are decentralized, censor-proof, distributed network. The "attacker" allegedly performed a double-spend attack by sending the 40K ETC and then rewrote the block(s) so the transfer never happened and the 40K coins still belong to the original wallet.
But what if the attacker is someone else? What if he's a person or group that transferred 6,000 coins for double-spending that was on the same block(s)? The 40K would be a by-product, who knows how many transactions were in the block(s) affected and which ones of those belong to the attackers (most likely more than 1 transaction).
Finding out who owns the wallet is possible if there was history associated with a person or group, and even then, it could be someone outside of the country of jurisdiction (i.e. China). What then?
There's a whole discussion of tainted coins which can be applied here if the developers of etc choose to do so. For example, if you deposit bitcoin that originated from the darknet wallets in the past several transaction history to Coinbase or some of these centralized exchanges, they will freeze your account. Tumble the coin by exchanging for Monero and back to bitcoin before depositing to Coinbase is good practice.
