After a long search I located hacker BTC wallet,where he put BTCs after selling stolen LTC, BTCD and XC and most likely from some other stolen coins from Cryptsy too
https://www.walletexplorer.com/wallet/1356a64174770337This is list of hacker BTC wallet addresses and amounts on them:
1C6JEkN16FqyLH37vvmSicE59kqEadUmtf 1044.4783332
1EycjnLMwsu3TGkmRXk2KcQFKfMDms3BPh 543.96196074
1LDJRDYwqaMeP4fohtKCk9rC4yNp84ZwBj 539.76554775
12wjDTKN7VJ7EzGpXhzUugRn9EksAE7V54 529.15362786
12jbr2aBAvepnhLVzH7FmEJSj5vhV12AVc 525.12341805
16GND7hK2G6ng1wkZeotEboAAXCJQ3oFMS 198.38328147
19tZeUPgr79fPcnF7kZ5Auibng5MJu8ZXV 92.68801239
1CH76kqRrgi1bNKBR2No58D2Ww4ZMLNnAz 24.3806
1KCUsmS1yno86E1WyaezJryBLeFPTBvgSS 20.91127867
12pph89q6WqBnfSMyhTbB9jY3Qy42ckkSY 0.
152kBAm48m7qpJ435LnvskYNyQk5zdE7oR 0.
1KLAEfwvJC8awiuigk5CrQ8dVB2XsXjABm 0.
13hvDJDXC95hgvBqbf3zVpQiYct8FTv2GZ 0.
1MWcNSArYxzR2JxAqs7fSi9hnKMgf1KfNM 0.
121nt1QeEZTbSRREaEGvKcqCmTQkhCcDAX 0.
1CCN21uVdp95LHJtXh53B6BC7M3s4y63Mo 0.
1FDDuyhunAtBb287WNmJEEwr6s24yvEQTv 0.
15wzuUsgz5Wia8i5mrEYp3p8ciHPbi1v4h 0.
1JuyFXAYuS4RHdaxrZDjE1f6XtFPRQdhYP 0.
I was tracking Bittrex BTC wallet outputs on dates when he moved stolen BTCD and XC on Bittrex.Hacker moved and sold BTCD and XC on Bittrex in period between 14.Oct.2014 - 07.Nov.2014.I did it ,because Bittrex is a small exchange in comparison for BTC exchanges,there are no much big withdrawals,and every such one can be easily identified and tracked.
Inside hacker wallet there is address
1C6JEkN16FqyLH37vvmSicE59kqEadUmtf :
https://www.walletexplorer.com/address/1C6JEkN16FqyLH37vvmSicE59kqEadUmtfon that address hacker put BTC after selling BTCD and XC on Bittrex and LTC on BTC-e(11.July.2015)
If you carefully look on inputs at that address for period 14.Oct- 04.Nov.2014 - they are all from Bittrex.After this period new inputs started again on 11.July.2015 - day when LTC started to moving to different exchanges.As I wrote in mine previous posts, 55000 LTC moved 11.July on BTCe exchange to address:
LY13Z54QKwyAnuwKfYwKFhW98qa6ihsfYy and then to BTCe LTC hot wallet -
LXA3i9eEAVDbgDqkThCa4D6BUJ3SEULkErHacker sold 55000 LTC on BTC-e 11-12.July.2015,but could not move about 935 BTC all at once,due to BTCe daily withdraw limit of 100 BTC,so you will see a lot of inputs of 99.999 BTC on
1C6JEkN16FqyLH37vvmSicE59kqEadUmtf from 11-25.July
All inputs on this address for period 11-25.July has a total sum of about 930 BTC.
Average value of LTC for 11-12July on BTCe,when hacker sold them was 0.017 BTC for 1 LTC:
55000 x 0.017 = 935 BTC
If you trace backward(with help of Wallet explorer trace largest sum(branching BTCe output) in every txs) all BTC inputs on address 1C6JEkN16FqyLH37vvmSicE59kqEadUmtf for 11-25.July have point of origin in BTCe exchange wallet.
Also hacker wallet
https://www.walletexplorer.com/wallet/1356a64174770337 for a period 18.Aug.2014(when it formed) till now you will see that all inputs in it has a total sum of ~ 4685 BTC
Sum of stolen LTC,BTCD and XC is:
2475000 LTC x 0.015 = 3712 BTC
107400 BTCD x 0.007 = 752 BTC
289000 XC x 0.0007 = 202 BTC
---------------------------------------------
Total: 4666 BTC , very very close to the sum of all inputs for that wallet
I have also tested dozen other transactions (traced them backward) in this wallet
https://www.walletexplorer.com/wallet/1356a64174770337 and found that BTC inputs which came from LTC selling(11-25.July.2015 came from Huobi, BTC38 and BTC-e,like I found and wrote in previous posts.
First 8 inputs in this wallet
https://www.walletexplorer.com/wallet/1356a64174770337?page=3 ,has point of origin BTC38.It was before LTC,BTCD and XC started to move,so it is most likely from some other robbed coins,which Cryptsy did not report or even did not aware.Also hacker sold on BTC38 and BTER till 14.Oct.2014 coins in total value of about 200 BTC.It was before BTCD,XC and LTC started to move - so it is some other stolen coins never reported.
This is a list of BTCD and XC transactions and dates when they came to Bittrex:
XC11
https://chainz.cryptoid.info/xc/tx.dws?198609.htm - moved 24.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?411249.htm - moved 07.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?380728.htm - moved 24.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?395694.htm - moved 31.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?373715.htm - moved 20.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?373818.htm - moved 20.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?393371.htm - moved 30.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?399652.htm - moved 02.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?380702.htm - moved 23.10.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?398810.htm - moved 01.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?399528.htm - moved 02.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?399682.htm - moved 02.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?399688.htm - moved 02.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?399694.htm - moved 02.11.2014 - Bittrex
https://chainz.cryptoid.info/xc/tx.dws?411262.htm - moved 07.11.2014 - Bittrex
BTCD
http://explorebtcd.info/tx/8d20bdcc209a724f9769707578d69bd39bfa108636ae3df7664f8a56629e67af - moved 24.10.2014 - Bittrex
http://explorebtcd.info/tx/a035693c30b9d6ad2fe9b8e1df8fb41e672b292546065863e73095838965344e - moved 14.10.2014 - Bittrex
http://explorebtcd.info/tx/3cdd16fe894e7039b4edeefae27d40ce355d44ac0a98ed7e3715ca117d2befde - moved 30.10.2014 - Bittrex