Hey there! Nice to meet you!
Based on your description, I'm afraid the only way to recover the account is through the account recovery web form: https://account.live.com/acsr
You'll need to keep trying until you're verified by Microsoft, and you can do this up to 2 times every 24 hours.
If your Microsoft account recovery request was not granted, please review this link for tips on improving your chances of a successful recovery: https://support.microsoft.com/office/dc56c3e3-dff0-4ed5-8edb-60290eea6b53
If you are able to recover your account, you will need to update the verification method on account.microsoft.com > Security > Manage how I Sign in > then add your email/phone number as your verification method.
Once you're done, you will need to wait for the 30-day restriction state to complete; but, since the hacker has their email added to your account, having them in full control over your account, they can simply cancel your security info change request.
If this happens, you will need to try requesting again, and hopefully, the hacker will not notice.
Unfortunately, it is also not possible to bypass the 30-day restriction state.
However, if the 30-day restriction state is complete, you will be able to remove the hacker's security info email from your account using your newly added security info.
Lastly, please be advised that Microsoft Support will not be able to assist you with manual recovery, unblock, and escalation for this case, as stated in this article, that they are not permitted to send password resets, access, or even change any details on the account:
https://support.microsoft.com/account-billing/help-with-the-microsoft-account-recovery-form-b19c02d1-a782-dee6-93c3-dc8113b20c42
Thank you for your understanding! Please let me know if you need anything else.
Best regards,
Darhyl