I think they have sold some of the stolen tokens into ETH already, but still have not move the ETH yet.
The stolen ETH will be very hard to move without being traced and the hacker will be caught if we can trace their ETH address thoroughly.
Some of their tokens and ETH was frozen by the exchanges. So now they will be trying to liquidate them using the DEX sites. Anyway, it is going to be very difficult for them to convert these crypto assets to fiat cash. Converting from one cryptocurrency to another cryptocurrency is not that difficult. But that is not the case when you convert cryptocurrency to fiat cash. It is next to impossible to stay 100% anonymous.