When you browse to a .onion website the web server sees the connection coming from the hidden service operator's Tor client. It is common (though not the most secure configuration) that this instance of the Tor software is running on the same machine as the web server, in which case the web server's access logs will show all traffic originating from 127.0.0.1 ("localhost", every computer's address for itself). It is better to insulate the hidden service on a private network so that if the web server is compromised it cannot learn its own location; in this case, the web server will see all connections coming from some private IP address where the operator is running their tor client.
On a more technical level, if the hidden service operator were to look inside of their tor process (such as by modifying their copy of tor, or using a debugger) the closest machine to the .onion visitor which they can identify is the "rendezvous point". This is some regular Tor relay, chosen by the visitor/user, which both the hidden service and the visitor have built full 3-hop tor circuits to. A network observer at either end should not be able to identify the rendezvous point, but both the hidden service and the user know where it is.
There do not need to be any exit nodes involved in a connection to a hidden service (although, any of the nodes might also happen to be exit nodes). The rendezvous point plays a similar role to that of an exit node, but it doesn't require the relay operator to configure it specially (as being an exit does) because there isn't the risk of abuse complaints that comes with being an exit to the internet at large.
As previous answers have said, cookies do not by themselves reveal IP addresses. But, they can be used to "link" subsequent visits (perhaps from different IPs) - meaning, identify them as being from the same browser. Tor Browser clears all cookies whenever it is closed or you click the "New Identity" button. It also disables 3rd party cookies, so the facebook button on site A doesn't know you're the same person as the facebook button on site B (unless you go there at around the same time, in which case they can guess you might be) because facebook can only see your facebook cookies on requests where facebook is the site in your URL bar (the "first party" site).
HTH HAND and happy hacking