How Does an Attacker Cash out Their Illicit Gains?

After successfully double-spending, the attacker holds a liquid asset (e.g. Bitcoin, stablecoins) obtained from the exchange.

They typically move this asset through mixing services or multiple addresses to obscure the trail. Finally, they may use peer-to-peer exchanges or centralized exchanges with lax KYC/AML to convert the crypto into fiat currency or use it to purchase other, less traceable cryptocurrencies.