As said on the main thread, the only place to sell any significant amount of coins would be on the exchange they stole from. 

Only a small percentage of Polo's total is in their hot wallets.

This sounds like Bitcoin in 2011 and the MTGox hack. Bitcoin is alive; however MTGox is dead.

Speaking of regulatory framework, the BitLicense is out, and this part stuck out at me:

"No Licensee shall engage in, facilitate, or knowingly allow the transfer or transmission of Virtual Currency when such action will obfuscate or conceal the identity of an individual customer or counterparty."

In other words, if they are using a mix-in value greater than 0 for individuals in the State of New York, might it be a problem for them?

If they transfer to another address (when you withdraw your XMR) with, say, a mix-in of 3, will they not be "knowingly allowing the transmission of Virtual Currency when such action will obfuscate or conceal the identity of an individual customer or counterparty"?

Right, but, while technically, even transferring BTC to another address doesn't imply that they or anyone knows the individual holding them anymore, it doesn't necessarily "knowingly obfuscate or conceal the identity" like a mix-in does.

Right, but, in that case, then *any* withdrawal to another address in *any* cryptocurrency that doesn't tack on your identity along with it would be knowingly obfuscating or concealing your identity.

No, just thinking through the ramifications that may come about because of this.

Another, possibly more practical, way to look at it might be that at the point where they carry out a withdrawal, you don't qualify as their customer for those funds any more. You only count as their customer for transactions done *within* their system. You could even withdraw to someone else's address directly to pay them, so there's no reason to assume that it is the customer's address or coins at that point. At least for BTC this might fly.

However, for XMR, I still think that if they are knowingly using a mix-in higher than zero, then that might be construed as obfuscating or concealing the identity of an individual customer. Obviously, practically speaking, a person can easily re-send the amount they withdrew to another address using a higher mix-in value themselves, but that's not the point here.

I don't really see it. If they are sending coins to you, then where those coins came from (which is what mixing does) is not obscuring the identify of you as their customer. They will have a record of sending coins to you, along with your KYC information. Should be good enough.

To me that sentence prohibits allowing things like straw buyers. I don't know how it would be interpreted in practice though, that's one of the problems with writing regulations for technologies that are in a fluid state of development and not even understood by the people writing the regulations.