Transactions tracked after Nourzai’s late 2024 release show the stolen ETH moving through zkSync, Starknet, Solana, and multiple EVM-compatible chains.