BitStamp Theft Bitcoins Being Spent
The BitStamp Theft coins are more than on the move, they are being spent or being prepared for spending. The controller of the 1L2Js address has a
Up until block number
The very top transaction, 8328a2 contains 13 inputs from the 1L2Js address associated with the theft. The gathered amounts are then peeled off until we have two 1BTC amounts in the 15wsX address.
Quick sidebar: note that even though the entire source of the BTC can be traced back to the hack, we cannot presume the controller of 15wsX is the same as the controller of the theft coins. It is very easy for each of those peel chain steps to be the deposit to another party willing to buy hot bitcoins. There were 5 places in this chain where it could have happened, so it is a possibility that cannot be dismissed.
This part of the chain is where the external linkage happens. For
This transaction is either a simple
The exact same pattern is seen for the other transaction as well. My conclusion is that the loose change address is intended to "wash" the bitcoins by spreading the taint of their source around. However since the wash amount is less than the output amount then at least some of the BTC in the 1HRv8 address had to have come from the previous address, removing the plausible deniability. This isn't the best washing job I've seen.
This may be a transaction only designed to test the waters for identification, but I think it is safe to say the thief intends to sell or spend the proceeds of the