They usually don't. They just stay in the attacker's addresses. I would say the best way to go would be to using bitcoin mixing services, but then the attacker

They usually don't. They just stay in the attacker's addresses. I would say the best way to go would be to using bitcoin mixing services, but then the attacker would open themselves upto a huge risk of getting caught if the mixing wasn't perfectly secure, when they eventually go to an exchange.