Most of the addresses where the hacked funds are currently held are vanity addresses, containing some variation of the term “F*ckIRGCterrorists” within their public key.