According to on-chain detective Specter on their personal channel, the attacker's address associated with the CryptoBilis Ledger hardware wallet incident deposited 2,990 ETH, worth approximately $7.45 million, into Tornado Cash between October 9 and 10.Monitoring data shows that the attacker had previously withdrawn the related funds in a dispersed manner to 14 addresses, then used NEAR Intents to cross-chain convert the funds to the ZEC network and further conducted privacy protection measures. The attacker showed signs of address linkage during the fund transfer process. Some of the withdrawal transactions reused wallet addresses previously used for deposits; other withdrawal transactions were initiated by wallets associated with the wallet address that paid Gas fees during the theft, thereby helping researchers trace the fund flow.