Just transactions analyze in block explorer.
first attack on block 3084602 31 Aug
addr using for attack
En381X95MxxGFhvRbJEpvnTHF7c8Ee2eoY
EqJqjECZ6DumRohHrnSffxf59X4Cng4Yon
Ek99BAgje1i7pCPShrKjJWBD9fJB3Zbgw5
EhRdJn3FXV6hFVBde1zUWMJetmdp625ux2
F38qG6p7hb6T5bfi3CeYFB4raE93XQG3t4
EvUn8btCmPeUXgMBmfn3RykykGguLZQFss
EyvNBPFNY1wAqEDKc5MhUf3w1sfBTwe5bp
F2ikUi5WGjvKap8mb87rmPBgx37ogBo5e1
EwMEjpkm2pJ9KjNCQTdFoHPu1SzARBqpc4
EhHuaDFdxehp63SV3xscTJv694TKNGmSAL
addr for attack 2 see in transaction
13c46bcbab895d657519ca2e3539fff23df81bbd7bce40db924fea46e959961f
the earliest hackers address F3pU2up8mZgjVxysBaBqoS1YSbUyZmLZ3G
He start mining September, 25 2014.
First mined 10 CAP f1b93edc65a26d2228e7b590556855ed11e1aab3647228c9936470318b064662