According to the monitoring on Beijing Lian'an Chain, at 3: 9 pm Beijing time, the stolen ETH on the Upbit exchange started to transfer accounts to three addresses in the form of ladder amounts with 10, 1000, 10,000, and 100,000 ETH, respectively. Finally, all ETH was transferred out at 16:55 with a transfer of 109,270.16 ETH. In the middle of these addresses, 100 ETH each returned to the address where the stolen funds were transferred for the first time. At the same time, the attacker was also conducting exchange Testing of micro ETH transfers. From the perspective of behavior characteristics, the attacker is conducting the first stage of decentralized transfer of stolen ETH to disrupt monitoring. At the same time, after the incident, a large number of other "to-the-walk" trace ETHs, even various ERC20 tokens, which have entered the hacker's address, will further disrupt the relevant ETH circulation leads.