Before the Tornado Cash deposits, the attacker dispersed the related funds across 14 addresses.

verified span

“Monitoring data shows that the attacker had previously withdrawn the related funds in a dispersed manner to 14 addresses, then used NEAR Intents to bridge and convert the funds to the ZEC network, and further carried out privacy-preserving processing.”