4/5 Some of it did move, and the route is visible hop by hop.
12,719.46 BNB left Bitget's hot wallet at 19:16 UTC on 24 September. The amount then travelled through a chain of wallets, shedding a part at every step: 10,710 → 5,896 → 1,889 → 550. At 08:11 the next morning, 411.73 BNB reached THORSwap and were swapped into bitcoin.
Roughly 13 hours from the exchange to a cross-chain swap. On TRON the stolen TRX was swapped to USDT through SunSwap, bridged to Ethereum via USDT0 and sent down the same route. Smaller amounts went through Across, Bridgers, Chainflip and FixedFloat.