WashingtonAnalysts linked the wallets to North Korea.
The hackers moved more than $30 million as regulators weigh licensing the platform.
The trail sits on a public ledger, visible to researchers, and no protocol rule can block it.
Funds reached exchanges including Kraken, LBank and KuCoin, where enforcement can still act.
Sources: CoinDesk