Jun 10, 2020

So for context, it seems that someone is running software that is trying to find and exploit duplicate 'r' values (i.e. multiple transactions coming from the same address). What we're seeing is that anything coming into a compromised address is immediately sent through to another address outside of our control. Now they are not trying to be stealthy they are using the same target address to send their stolen BTC to each time. In fact they also include an output from that address as a secondary input to the 'stealing' transaction (I find this weird).