Hi JTO...
The thief robbed you using transaction
2e9499320568eb64dc695928b3cf4b409c97a61e5dc6a9574dae4c8e703c0a8e
From this transaction, we can deduct following address are part of YOUR wallet:
18bFg7hr1RD5CGd1Xjx61QKF3C3Db5KD6h
18ycmB63hbXJT4XvmGBMCeHkuDMNSSXoQH
1FvotYR8JZQY7huz6diA3T4RtpmwcUyh4K
We can also deduct following address belongs to the thief:
1EdnLXoWy2DJnwgJbvzGRH72Wx2VYxYzDV
By tracking 1EdnLXoWy2DJnwgJbvzGRH72Wx2VYxYzDV, we can see that the thief used his stolen funds to fund addresses
14Vc3rodXBCAMR8NXYJDzSv6X9FKVXxQ4e
16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j
using transaction 8e90f919752de1d35cb4ef83a2582ab3cc9de443c9aaf8fee20a2da6dad72654
The first stolen unspent output is not moving and is still funding 14Vc3rodXBCAMR8NXYJDzSv6X9FKVXxQ4e
The second address (16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j) belongs to a wallet controlling
1AG9AeU6qW7Vzf61W369eS4if36mVJr8Ph
15txy8sNsXKAh9AxB3u43ULAzJChi1YqTn
13LeePnHr4FHwF9CcH8TcyW3tSC2vJKPJ5
1JDuTYYeijnQDeiwiZw6VeHGtDU1aYKjCS
1GjgiVuZvkpxcG5MajPTqFV422hs9cXFnB
16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j
1PGpArCFdWBqpt5tBA5AaEBnKLA4ZsQion
1H8Z4dF9SpPmpwVq2GW6sniByQvDu628tg
1FBKjhvzFcmWzLDsuTWtp6Fm16Yi3CoRt
1QKmQne8UQNV2CnYpMS6YfD5EHqGi4rXt5
17rT7wXr4VD7q4BWoKqbqM1F4tRbjW2SCo
12UmS7bNbCK1Tf3feFw5CQWniK6WxzNbDQ
15w8r6NkLuVg78uuWsBEYxEwvxVrmqnHVB
Since unspent outputs funding all these addresses were spent together in transaction f80a17289695a02f1478f193afe73722305bc225d9d12fd3c1269c94b29d191a
This transaction funds addresses 1MDgeDBEZJxKMFy1x6xQzHS4v5Sjhdk3Si and 1NBWjyCYcwfhyaqgQMzyagUgegSxrW2oYM
1NBWjyCYcwfhyaqgQMzyagUgegSxrW2oYM belongs to a rather extensive wallet, controlling dozens of funded adresses:
https://www.blockchain.com/btc/address/1NBWjyCYcwfhyaqgQMzyagUgegSxrW2oYMNow... What does this mean to you?A) 1EdnLXoWy2DJnwgJbvzGRH72Wx2VYxYzDV certainly belongs to the thief... If you ever find somebody posting this address, you can link it to a name
B) 14Vc3rodXBCAMR8NXYJDzSv6X9FKVXxQ4e and 16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j *probably* belong to the thief... Altough one of them could be a mixer, an exchange, a casino or some serviceprovider and the other one could be a change address... Altough the amounts seem strange to me... If i robbed you, i'd either try to wash all the stolen funds, or i would wash none of them.
My gut feeling tells me that 14Vc3rodXBCAMR8NXYJDzSv6X9FKVXxQ4e is probably an address belonging to the robber, and 16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j is either an address belonging to the robber OR a service provider. If somebody posts either address anywhere, this person is either your robber OR somebody that got payed directly by your robber... So you can tie those addresses to a person
C) IF one of the other addresses ever get posted, you can try to work your way back to the owner of 16YJ7uM8rwvXvA1o2YSdgvEsiHRT32Ma1j and then use this owner to find the owner of 1EdnLXoWy2DJnwgJbvzGRH72Wx2VYxYzDV ... Anyways, it becomes a longshot.