According to the monitoring of Chengdu Chain Security, Upbit attackers began to transfer stolen funds between 0xa09871 and several new addresses on the afternoon of the 28th. The attackers transferred some of the stolen funds to the new addresses and then returned them. The current distribution of stolen funds There are 229,170 addresses at 0xa09871, 110,910 addresses at 0x9a2071, 910 addresses at 0x3408edc, and 1010 addresses at 0xc7d64e650. The attacker may be testing the strength of the current community's monitoring of the funds. It is speculated that the attackers may choose to monitor the funds with weaker periods of time A split transfer or long-term holding of the funds is waiting for the heat of the event to decline.