On-chain investigation agencies have uncovered an interesting lead—cryptocurrency assets stolen during the famous password manager vulnerability incident in 2022 ultimately revealed their tracks.

The hacker group employed various tricks. Tools like CoinJoin, which are originally used for anonymizing funds, were compromised through de-mixing analysis and behavioral correlation of fund flows, allowing their operational patterns to be identified. Tracking shows that the funds gradually flowed into several high-risk exchanges, mainly concentrated on a few platforms in Russia.

The numbers are staggering—the stolen assets involved in the entire case are estimated to exceed $28 million. This case also demonstrates one point: no matter how much money is mixed, it can still be traced on the chain, especially when the fund behaviors at different stages are linked together.