I'm betting Gemini also blacklisted that BTC address, especially considering that they were in the first wave of fake tweets.
Now I'm wondering how much BTC the attacker effectively left on the table by reusing the same wallet address, especially considering that lots of people who deal in crypto use just a handful of exchanges to send it.