The attackers used transit addresses
, and some of them were created (deployed) directly with the help of stolen funds. However, each chain shows that the attackers did not try very hard to hide their tracks.
The largest of the chains we analyzed does not contain more than 5 transit addresses.
Ultimately, the attackers laundered funds to centralized exchanges (CEX).
The most popular exchanges were: Binance, MXC, Kraken, Kucoin, Gate, Exmo, Coinone and Whitebit. We talked about what CEX proposes to do in case of theft of crypto assets in this