Another option that works as of today is to set up a tenant to tenant connector.
Add a connector to the new tenant. Point it at the /api/login endpoint of the old tenant, including an API key as a header.
Change your app to send everyone to a new application in the new tenant.
When the user logs in to the new application, if it is the first time they've been seen, the old tenant data, including password, will be queried. The password hash will be transparently migrated to the new tenant.
This slow migration takes time, but is another option.