According to @lookonchain, a threat actor named John was baited into a “band for band” flex and live-shared his wallets. According to @zachxbt’s on-chain tracing cited by @lookonchain, the revealed wallets are linked to large suspected thefts and include funds tied to a U.S. government seizure related to Bitfinex. According to @lookonchain, an Arkham Intel address 0x8924B17fD7512953949DE703a7C97484E66E0Bec was shared, which allows public tracking of holdings and transfers for trade monitoring.

According to @zachxbt, after the B4B was done John moved approximately 23 million dollars to the 0xd8bc address, and a recording shows John controls both wallets mentioned; @zachxbt added that additional linked addresses may be identifiable in the recordings and that he began tracing funds backward to verify their source (source: @zachxbt).

According to @bubblemaps, bad actors are increasingly avoiding direct wallet links and rotating through CEXs and bridges to break on-chain linkages on bubble maps. Source: @bubblemaps. According to @bubblemaps, time analysis is now integrated into its clustering engine to address these evasion tactics, enhancing time-based wallet clustering for users who analyze token flows. Source: @bubblemaps.