If I were the hacker, I wouldn't try to sell the tumbled coins on an exchange (with KYC) for quite some time, too risky.
Instead, I would send them to multiple altcoin exchanges (that have no KYC) and pump up some less traceable alts.
Another possibility is to sell some of the tumbled BTC to fences on localbitcoins.