As reported on the day of the attack, the malicious child DAO aka “The Dark DAO” was located at 0x304a554a310c7e546dfe434669c62820b7d83490
Obviously this address is now empty on the forked chain (since retaking the stolen ETH was the goal of the fork). But now the address is also empty on the unforked chain (aka Ethereum Classic).
http://gastracker.io/addr/0x304a554a310c7e546dfe434669c62820b7d83490There's no decent block explorer for the unforked chain, so it rests on a sufficiently interested developer to inspect the blockchain directly for details of what happened. If anyone has the time, it would be very interesting to find out where the ETC was moved to.
https://www.reddit.com/r/ethereum/comments/4ukefq/attacker_has_withdrawn_all_etc_from_darkdao