so far I’ve seen the address used to subsidize the gas for today's attack appear in the ethereum-wallet.net hack
https://www.cryptocompare.com/coins/eth/post/p_49343
~one month ago which means that either:
- it is the same attacker
- this is a mixer’s address
Either way chances of catching this guy are greatly maximized, imo.
If it is the same attacker we now have him linked to a www hack which means more chances of traceability (if not very sophisticated)
If it is a mixer’s address then we can also try to see which mixer was used and go from there.
https://bitcointalk.org/index.php?topic=1689585.msg19493421#msg19493421
that post outlined the use of the same address:
0x57B174839cbD0A503B9Dfcb655e4f4B1B47B3296
also he ran 20 ETH after first wallet attack through Shapeshift
https://etherscan.io/tx/0xb2a1956d8debe02a9d7e9dae07571d4d29b4f896886dc6b811a3b2f9ca4ff352