Appreciate the updates on the hacker funds.
So we know that the funds have moved to exchanges, but how do you know they've actually been sold?
I timed 100s of transactions to exchange address, then watched for dump. 9 times out of 10 could see the dump happen in real time. Often the same exact amount as transfered.
A lot of people were buying stolen XEM on darknet market for 30% discount, transfered to exchange, dump, and repeat.
Knowing they were doing something illegal, I doubt many left xem on exchanges. Additionally, the daily volume reflects the dumping.