On-chain data shows that the exploiters wallets were funded by addresses connected to three notorious security incidents.