The attacker took USDC, ether, tether and PAYG tokens before laundering a portion through ChangeNow and Binance.