Sentinel Protocol tracked 25,533 ETH stolen in the July 2018 Bancor hack after the funds moved on 2019-03-13 following seven months of dormancy. The attacker transferred the ETH from the Etherscan-labelled Bancor Hack address through relay wallets, with most funds passing through 0xd294ac toward 0xf056f4. Uppsala's team assessed that 0xf056f4 belonged to Huobi after comparing relay-wallet behavior and ERC20 flows into Huobi-linked wallets. The source is blockchain tracing of stolen Bancor funds and does not attribute the activity to DPRK or another named actor.