I have been robbed after dust attack [closed]

Question

Dear colleagues of the crypto community!

I am Roman Frolov (Vader), a private investor and trader, was subjected to a new version of a micropayment attack (dust attack) and was robbed of about 335.84997800 bitcoins in a cold wallet via supposedly Bitcoin Core access.

Stored bitcoins in a wallet generated in Bitcoin Kore (Knot). Earlier in the year 2015 I added private keys from BitcoinHD to Knotts and then to Core. I stored the listing of keys in a document archived in 7zip with maximum security settings and a long password.

Source of funds: buying bitcoin since 2012, participating in cryptocurrency HYIP projects according to the rules, trading on exchanges, including leveraging on bullran in BTC-E in 2017, got under the closure of the exchange and after a while received 80%, to this day I trade on Bittrex Global and Kraken. Followed the law, ethics and property rights. Didn't steal a penny.

2021-01-06 18:39:38 hackers produced multithreaded output from 12 addresses: 15hT9GMi1ThhmJts24WKG1Jm3so7bmiuW4

16BjABjMQB8wshTVhTbQUqoPfKQi7sSNRM

15D9TctYq3DvK1eDmxWfp8FWP73a1a2hEA

1Gi7qn77XqtGknJ9dUc3yRAoRFgNXBQBiW

1EAN8MxjfmRToVwsoVtfSzRz2FsCN89unX

13P1YEZjPDTpCtaqMbTbhu6VB3csu3qsZu

19DrKeLdYd47wHvbhkvccYQ4fQNycfdzhL

15hT9GMi1ThhmJts24WKG1Jm3so7bmiuW4

16BjABjMQB8wshTVhTbQUqoPfKQi7sSNRM

15D9TctYq3DvK1eDmxWfp8FWP73a1a2hEA

1Gi7qn77XqtGknJ9dUc3yRAoRFgNXBQBiW

1EAN8MxjfmRToVwsoVtfSzRz2FsCN89unX

13P1YEZjPDTpCtaqMbTbhu6VB3csu3qsZu

19DrKeLdYd47wHvbhkvccYQ4fQNycfdzhL

1JLTq3VLiU4qY1DfC7fYs4N5g45HByjE8H

1CfEuYincqgWfMGvBx8o1ysArCSMQhqM4f

12hBEaVfHGRXL4HnFjrAdoWudKhWdCPaoU

1PsKsr8hR7DBKB9q76JZwhTwD5W5QWG9Fj

19zvjxagjet8PNiCk4D7ZjWqqfoaM2qdZG

Output was made in 601 transactions starting with the output address: bc1qxuyrx3n86nu0l5mf7wv8fzgkwn4vmeh5lqm2je 0.00291700 btc

and ending with 1B1ztXtrbnLWjMFGqSaW22DpdEWwiaoUbN 15.85027800 btc

the output went up evenly up to bc1qsx9q4cfpp33y4vxwhmr85n43zzv2qs85pr2jvw 0.97108300 BTC

and then 15.85 B1ztXtrbnLWjMFGqSaW22DpdEWwiaoUbN 15.85027800 btc

I ask everyone who is involved in currency exchange to pay attention to the withdrawal addresses from my addresses and their derivatives at 6 january 2021, and freeze their use and return to the original sender,

I hope for your justice, Roman Frolov (Vader)

Answer 1

The transaction taking the coins is very strange, the criminals have obviously got a strategy which requires the multiple denominations of UTXO's. It's not clear what this is but regardless the TXID showing funds being stolen is: de991dda2cd10a31bea1dd92c5e5466f916b060f5bd31fe0840b9fd08a0aa786

If you follow one of the outputs you can see via the following transactions that it moves to an address: 169ksrn7RgXFZmUVtvBFfbEKG5mmMxvQU7

TXID 1: fa53e39eb02809ea03986484325141d7e97c8a9b8c793974841b6850be43cd70

TXID 2: 177b996bdf4c2986faed0830a064242e553a8d914b0d7771561d5a017e2eca3e

This address resides in a wallet clustered under the following reference in walletexplorer.com: https://www.walletexplorer.com/wallet/00011cbc1c9321ec

When you review the activity of this wallet there is a lot of receipts and only one daily transaction out of the cluster to an address attributed to Binance (for the several days at least). No other exchange or entity is mentioned as an output. Given this my thoughts would be this is a hot wallet associated with Binance. As such if you have any contacts at Binance I would getting in touch with them.