Old analysis of the May 2019 Binance hack that netted 7,000 BTC from Coinfirm claimed that on-chain movements showed it was clear the hacker had begun liquidating the stolen coins on various exchanges and possibly converting them into other cryptocurrencies. Research from analytics firm Clain disputes this.
According to Clain's research published on Wednesday, the overload of the hacker's chosen mixing services, several safe assumptions about transfers, and a close look at coin clusters shows no evidence that the coins have been sent to exchanges.