In the indictment[1] he's not charged with theft.
He's charged with:
1) wire fraud (the smart contracts/swap exploit)
2) unauthorized damage to a protected computer (running the exploit on the ethereum network)
3) attempted hobbs act extortion (contacting kyberswap to attempt to gain control of kyberswap in exchange for return of some of the crypto)
4) money laundering conspiracy
5) money laundering (knowingly laundering the proceeds of the previous, including paying an undercover agent to help bypass a blacklist to do so)
[1] https://www.justice.gov/usao-edny/media/1388036/dl?inline
Hat tip for that indictment document. Here is the official press release (parent page to your doc?) from the Dept of Justice: https://www.justice.gov/usao-edny/pr/canadian-national-charg...
Yes, I cite that in another comment. The article calls it theft, well specifically they say "stole" but that implies theft.