On July 27, Eralend tweeted some progress on the hacker attack. It has discovered suspicious CEX accounts related to the hacker and provided relevant information to the police. In order to track the attacker's real IP location, it has submitted a formal investigation request to the VPN provider.