The hacker (3ax) used a new plug wallet with no previous history in order to pull off the hack-exploit. The only way to find out who it was is to now start tracking the $BTC addresses that were used after (3ax) swapped the stolen ICP to ckBTC and then converted that ckBTC to BTC.
#BTC