Originally, the hacker moved 85M USDC into the address 0x5dc3603c9d42ff184153a8a9094a73d461663214. There was no other hacked tokens (erc20 or MATIC) that were deposited to this address. Two days after the hack, the hacker transferred the hacked USDC back to PolyNetwork Multisig wallet. The hacker also made sure to transfer the USDC incrementally to avoid sending them to the wrong address. There's all there is to it.