The Ronin Bridge Hacker’s funds have been traced through Tornado Cash

He has deposited 21650 ETH to Tornado since 4 April: https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e2383e2f96

In that same timeframe, 11000 ETH was withdrawn from Tornado, bridged to Avalanche C-chain, and swapped for AVAX here: https://snowtrace.io/address/0x173784da5a76ea193f6968fa125b48b1a0fd3f05

That AVAX is obviously controlled by the hacker. What was the purpose of sending the ETH through Tornado if it can easily be traced to that AVAX address? Nobody is mixing their AVAX either. There's effectively no anonymity set on that chain.

Why wouldn't he use the routes that have the largest anonymity sets, and move smaller chunks to blend in with the crowd? For example:

ETH -> tornado -> renBTC -> BTC -> coinjoin -> XMR

ETH -> XMR