has long been following the hacker’s behavior. In fact, since the 23 March incident, SlowMist has been at the head of tracing the transactions that took place with the stolen money.The report claimed that on 28 March, the hackers— thought to be members of the North Korean cybercrime group Lazarus Group —transferred only a small fraction of the funds to centralized exchanges. These include Huobi and FTX .
“I’ve found the answer in Blender sanction addresses. Most Blender sanction addresses are Blender’s deposit addresses used by Ronin hackers. They have deposited all their withdrawal funds to Blender after withdrawing from the exchanges.”