The exploiters converted their ill-gotten gains initially to ether and then to bitcoin before using sanctioned mixers to mask their identities.