The hacker was frontrun by MEV Builder (0xa6c2...).
The stolen funds are currently held in 2 addresses:
0xbed2...dE25 ($3.3M) & 0x573d...910e ($880K)