All the "mixing" transactions were supposedly relayed by blockchain.info. I see a fairly high probability it's indeed an online wallet.

The initial hack was different.