A handful of the funds stolen from the accounts of the Japanese crypto-exchange Coincheck was traced to a Vancouver-based crypto-exchange in Canada.

Hackers moved a part of NEM coins stolen from Coincheck to a Canadian exchange, converted them to other cryptocurrencies and allegedly returned proceeds to Japan, experts from BIG Blockchain Intelligence discovered.

“We felt it was a significant amount that warranted looking into. They are trying to move it before the door is closed, but there is a lot to move,” said Shone Anstey, president, and co-founder of BIG.

He did not name the Canadian crypto-exchange, which was involved in laundering stolen NEM coins, neither he disclosed the amount traced to that exchange or the final address in Japan but said that this information would be transferred to law enforcement agencies.

Earlier Coincheck installed and published 11 addresses, where the stolen funds are moved to. In particular, according to the Japanese newspaper Akahata, more than 24 million NEMs were sent to the Japanese Zaif exchange. Whether Coincheck experts have been able to find out the identity of cybercriminals is still unknown.

The funds on 11 tracked addresses are labeled with a tag that reads “coincheck_stolen_funds_do_not_accept_trades : owner_of_this_account_is_hacker.” This tool for tracing stolen funds was developed by the NEM team. However, at least four of these addresses showed activity in the first days of March, with a total of 31 million NEMs withdrawn from them.

The hacker attack on Coincheck, resulted in more than 500 million NEM coins stolen, happen on 26 January. The incident triggered large-scale security audits of other Japan-based crypto-exchanges.