The first address used is 0x0d043128146654c7683fbf30ac98d7b2285ded00
It's a bit harder to trace using public tools because they immediately start splitting off the various coins to other addresses, but looking at just the USDC:
They split it off into a single purpose address that is just responsible for converting it to ETH. They do this via private transactions utilizing uniswap v3 and a set amount just about every minute (they settled on ~2M). If you scan through them their slippage is very good here. If you wait a bit of time you let the arbitrage bots move funds from wherever is available so your slippage isn't so bad.
account responsible for USDC conversion: https://debank.com/profile/0x58f4baccb411acef70a5f6dd174af78...
This account was also responsible for a number of liquidations: https://debank.com/profile/0x9e91ae672e7f7330fc6b9bab9c259bd...
They again show good slippage and also show that they use 3 different exchanges
After they've converted everything to ETH with good slippage they then fan out to multiple accounts that then do a series of deposits into tornado cash at 100 ETH each.
They were done with the liquidation within 2 hours. This attacker is still liquidating as far as I can tell