You can see here my OP :
and another post soncerning the Address used to stock the stolen SM funds before they were tumbled :
Now i wanted to show you how the tumbler used work.
Here is a bitcoin address in the middle of the first tumbling that is very interesting.
I don't know why but in the tumbling this address was used 2 times, and so it shows very well the two main actions that drives the tumbler used and the mix of the funds. These addresses used multiple times in the Tumbling process are very rare but they show well the system.
First time as a normal point of the tumbing track, you can see that a big amount of 488 BTC first come to this address, at start it was a 500 BTC packet which is on the track for tumbling.
1P85Ze6WR3WBmHsaFq1mgKLTDzd3pngq2C
Tumbling action :
Funds are sent from the original address where all the bitcoins were stocked after the hack, (here you can see 488 bitcoins entering and then a little less out) to another address, often a one time address with an aleatory amount that is separated, and sent to what we will call internal Tumbler addresses.
The funds continue their way on the main track until the 500 BTC pack is completely sent in the tumbler.
Then the internal Tumbler Addresses are gathering the small amounts that were taken each time from the main track, and gather them in wallets of different sizes.
Here you can see the 2 actions of the Tumbler, the main track with big transfer of 488 BTC and then the gathering of the internal addresses of the Tumbler, and the mix of the funds.
Later you will see on the blockchain that the separated Tumblers tracks then mix between themselves and go to another turn of tumbling...
Here you can see one the addresses used to gather the funds after the first tumbling and put them back in the tumbling system.
17LKtzNXD67hLfyt8gJGZfaWa3Kb2ntD4J
1GRmDsMiXK4Z4jEkTmU5PLwAZmUxaa7oQf
If you continue to follow the 5000 BTC funds that have been gathered at the end of the tumbling track you can see that they are again separated into 1000 BTC packs to be puted back in the tumbling system...
The second tumbling track was however far more simple than the first i have noticed, bigger amounts, less loops and less internal tumbler addresses, also it is a whole new track, no old addresses of the first track are used.
I have also noticed a part of the funds are still tumbling as we speak...
Here you can find a small wallet, a small part of the SM Stolen funds which are at the moment dispatched on thousands of addresses.
1NvX7GyHTRHz6DZcHBXvnPj1VSd3159wkM
1NAQFSfDDG1vuPMSVtf6S28bfX9XCT2Yzy
I don't know if they are going to be tumbled more of if it is the final storage wallets but there are in the end hundreds of wallets like this with various amounts.
Very Interesting indeed if you want to understand how the SM stolen funds are tumbled.
I was just following the addresses you gave, and it seems odd that everything just seems to be being moved, and paying transfer fees etc. it's never broken up, just losing a few % as commission.