A forensic question about the Coldcard attacker: how could someone actually cash out hundreds of BTC?

Hello,

I was thinking about the Coldcard incident and what an attacker who now controls hundreds of stolen BTC could realistically do.

The interesting part is not moving the coins. The blockchain is public, the addresses are known, and every transaction leaves a permanent record.

The real question is: How could an attacker turn such a large amount of BTC into fiat money without exposing themselves?

I came up with two theoretical ideas and would like to hear what people with more knowledge about blockchain forensics think.

The first idea would be extreme fragmentation. The attacker could split the BTC across millions of wallets and create a huge amount of transaction activity. The idea would be to make the connection between the original stolen coins and any future conversion into fiat much harder to establish.

Would something like this actually make forensic tracking significantly harder, or would analysts still be able to identify patterns because the entire transaction history remains visible?

The second idea would be cooperation with a powerful external actor, for example a state actor or organization with its own infrastructure and resources. Instead of trying to solve the problem only through technical methods, the attacker could rely on an entity with different capabilities and incentives.

Would something like this actually solve the problem of converting stolen BTC into usable wealth, or would the transparent nature of Bitcoin still make it difficult?

I am curious what others think.

What other options would a sophisticated attacker consider? Do these ideas make sense from a forensic perspective, or am I missing important factors?