The unidentified attacker moved funds through ether, instant exchanges and Monero, but the victim and affected exchanges remain unknown.