Here is where the funds were initially deposited after they were stolen
Here is where they deposited the funds (Only 10ETH of the total) into Tornado:
After another 10 Eth is deposited into Tornado, 10 Eth is withdrawn (minus fee) in this transaction using 0xproxy .eth as a relayer
The 10 Eth is split here in this wallet
After they split the Eth, they send a little over 4 eth to this wallet
Where the Eth is the sent to @coinbase in this transaction
While this is not absolute on-chain proof (common sense tells you it's the same person but we need evidence to prove), we believe that we can match the Coinbase account with the website registration @TheJusticeDept @JusticeATR
If for some reason they don't match, we can also cross check the logins of
with all of the other info provided.
Please see original thread for even more information.
this twitter thread.