Found something interesting while looking at new txs made to an address containing hacked coldcard funds.
Funds were sent from an Ocean miner payout address to an address linked to hacked coldcard funds and then that UTXO was peeled off immediately.
Could this dummy have accidentally sent his mining pool payout to the address containing hacked funds? Copy pasta mistake?
Block whose coinbase paid miner (tag OCEAN.XYZ):
https://mempool.space/block/960511
Miner payout address (payout sat here ~14h 40m before moving):
https://mempool.space/address/bc1q9yz2ajh00pq564mu3hfmrafl4hl3fajkr6fuj2
Tx sending that payout to address containing stolen funds:
https://mempool.space/tx/c7a9ad4877ee2971b649cb6e44a760d57371b51ddf5f3de5222d404556020d4b
Stolen funds address (current balance ~0.69 BTC of stolen bitcoin):
https://mempool.space/address/bc1qayw8nrec0vsa5vj4xee4dqhfgztx2gqq7w2u0s
Tx moving funds that originated from Ocean out of the address containing hacked funds:
https://mempool.space/tx/24f4b236bc47fc2ad85287e8636e9a14ba55e136ff3bf8b452f6d6b92d4e5187
