I have to correct that:
One story from Thailand (https://www.soccersuck.com/boards/topic/2066066, I used Google’s page translator obviously) and one tweet (https://twitter.com/HilgersDennis/status/1446744834551783428) both mention that final address in reports about scams/hacks in last October.
So, that’s a new one: A hacker that delegates and makes no moves to cash out for two months.
EDIT: Oh, and there is also one report in this forum:
Unfortunately, none of them describe exactly, how it was done.