How would the Coldcard attackers actually cash out the stolen BTC?

I'm curious about the practical side of this.

If the attackers really have hundreds of BTC stolen from the Coldcard incident, how do they realistically turn that into usable money?

For example:

• If they send it directly to a KYC exchange, wouldn't the exchange potentially flag the coins as stolen and connect the deposit to their identity?
• If they use a DEX to swap BTC into another coin, the transactions are still publicly visible, so does that actually solve the problem?
• If they sell P2P/OTC, isn't finding someone willing to buy a large amount of obviously tainted BTC pretty difficult (and potentially risky for both sides)?
• Could they simply hold the BTC indefinitely and wait for the attention around the theft to die down?