Compiled Findings About Addresses Involved
so far I’ve seen the address used to subsidize the gas for today's attack appear in the ethereum-wallet.net hack
~one month ago which means that either:
- it is the same attacker
- this is a mixer’s address
Either way chances of catching this guy are greatly maximized, imo.
If it is the same attacker we now have him linked to a www hack which means more chances of traceability (if not very sophisticated)
If it is a mixer’s address then we can also try to see which mixer was used and go from there.
that post outlined the use of the same address:
also he ran 20 ETH after first wallet attack through Shapeshift