If I were the hacker, I wouldn't try to sell the tumbled coins on an exchange (with KYC) for quite some time, too risky.
Instead, I would send them to multiple altcoin exchanges (that have no KYC) and pump up some less traceable alts.
Another possibility is to sell some of the tumbled BTC to fences on localbitcoins.
Correct.
If I had that many hacked coins, I would sell no more than 10 coins a day, and would prefer to sell them offline or use localbitcoins.com