According to Global Ledger analysis, $85 million of stolen funds from crypto trading platform Phemex is flowing through a series of transfers, protocols and coin mixing services. Hackers began to split the funds into multiple new addresses and transfer them to the Tornado Cash mixer. The first 2,080 ETH (about $6 million) has been dispersed to 14 new addresses, and the current main attack wallet has less than 4,000 ETH left. The transfer method involves multiple jumps and cross-chain interactions. In addition to transferring funds directly to Tornado Cash and eXch mixers to anonymize, hackers sometimes use platforms such as Wintermute, DLN Trade Protocol, and THORChain to exchange assets.