Investigators into last month\'s crypto-heist at Coincheck in Tokyo believe that the hacker is using the dark net to try and exchange the stolen XEM coins for other altcoins. The JPY58bn ($528m) worth of NEM Foundation\'s cryptocurrency was said to be the biggest theft in world history, but NEM had also tagged the tokens, making it difficult for the hacker to dispose of them.

Sources say that whoever owns the account with the stolen funds is using heavy encryption and various anonymous connections in an attempt to move the funds. Messages from that account have been sent out to a number of other accounts, containing a URL address and promising a 15% discount to anyone willing to trade.

The URL directs to an English site offering to exchange tens of thousands of Japanese Yen-worth of XEM for Bitcoin. A cyber security expert believes that the messages originate from the dark net, to further disguise the hacker\'s identity, and that eventually the hacker will have to resort to trading the stolen cryptocurrency for cash. 

Earlier this week, the National Intelligence Service in South Korea alleged that the hack had been perpetrated by North Korean agents, but had no evidence to substantiate the claim. They had flagged it as a possibility, but so far the hacker remains unidentified.