How do you know that?
I am interested in combing through blockchain and would also like to be able to recognize when that happens.
So, what are the signs to look for?
it was mainly a(n educated) guess based on the facts that i had at hand
he said somebody stole his coins so that is the logical move afterwards specially from someone who used a Bech32 address and paid a huge fee to steal the coin (so the hacker is familiar with bitcoin).
then it was divided to multiple transactions sent out in different steps with regular fees and the amount seemed to be round with a "mixing fee" included", at least that was how it looked to me. and my search for the receiving addresses didn't bring up any result for an exchange which increased the likelihood of it being a mixing service but it might as well have been an exchange like ShapeShift which is practically mixing in a way.