What I don't get is why the attackers didn't exchange at least some of USDC/USDT to ETH, looks like it took ~1hr for Circle/Tether to lock the wallet.

They did, I'm seeing 700 million but there is still movement going on