I cam across this article many of you may have already read:
https://ciphertrace.com/twitter-hack-update-blockchain-analysis-helps-identify-twitter-hackers/

It states at the bottom that "Through proprietary clustering algorithms, Cipher Trace is easily able to identify these mixing services", where it is talking about the hackers using various mixing services.  Cipher Trace shows various diagrams, which are not clear to me but are these diagrams showing the flow of funds through the mixing service or is Cipher Trace merely saying they lost the funds after they hit the mixing service?