If anyone is interested, I wrote a python script to track where transactions from this address lead. It constructs a tree with this address being the base node, and addresses it has sent bitcoin to being the leaves.

https://github.com/lukabuz/BlockView

It didn't really lead anywhere substantial, but it was interesting to see how many addresses got involved after the depth of the tree exceeded 4.

As another commenter pointed out, some of these addresses have obscene amounts of money going through them. Really makes you think about the scale of these tumblers. 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s is an example, with about $108,081,555,724 having gone through it, and a current balance of $51,644,803

clicked through the transactions and found this wallet: https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApi...

a balance of 16m and over 1.4 trillon usd has passed through this account.

the oldest transaction i could find was 2019-11-02 14:19: https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApi...

I would assume one address with 377k transactions that has seen over 131 million BTC move through it strongly implies it's some sort of tumbler address. I'm not sure why reusing one address like this would make any sense though...

It is more difficult to trace funds through a single node with gazillion transactions. This is part of the laundering scheme. Of course, all such addresses are immediately suspect, but if they pay out to innocent addresses too... It's difficult to distinguish between signal and noise.

Isn't that overcomplicating things though? If tracing is a concern, why not use Monero instead?

Kinda funny to see 1BTC sent to check it worked before they sent the rest. Cant undo it like a wire transfer...

But why 1 BTC? That's worth more than 10k. Surely they could have sent a fraction? Or maybe they didn't know bitcoins can be split?

10k out of 4.3m

10k is not that much considering they are ready to pay out 5M

No but isn't it just as easy to send a fraction of a bitcoin? Why spend a whole one to do something you could do with 1/100th?

1 BTC is a fraction of 400BTC

Probably a condition of the ransom. If the wallet address is known, then it can be blacklisted by exchanges.

Lol as if they'd just send straight to an exchange.

Maybe not, but it still makes them easier to trace.

Can the money be followed here? How they are going to spend it if it’s marked as stolen?