1. The attacker has enough capital to load up on HTZ calls or TSLA puts.
2. The attacker has been planning this for a while.
3. The attacker is a US citizen
If any of those is not true, it changes the risk/reward considerably.The money one is easy. Even if you get a bunch of call options for free, and if you manage to temporarily push TSLA down 10% (unlikely), then you still need $900,000 in working capital in order to exercise enough of those options to be able to dump them later for a $100,000 gain.
#2 and #3 adjust the actual risk of the operation. #2 because shoving the money around quickly gives a clearer signal for the SEC to pick up on, and #3 because triggering a whole bunch of extra KYC red tape risks getting even more hounds on your trail.
BTC does have to be turned into fiat. But I can only assume, based on how rarely people who conduct ransomware scams and the like seem to get caught, that bitcoin laundering is a solved problem.