The attacker(s) behind the crypto industry’s largest exploit have started to move some of the stolen loot through anonymizing services.