Following the quick analysis I made on the way back from Shanghai I was pointing to an address almost empty now and was initially funded by a tx from shapeshift among other tx from shapeshift: https://etherscan.io/tx/0xc6b62e729b7ce0cb2f919fe2e015404e99bc6077dfef55846272069a38538b97 I have been harassing the customer service of shapeshift and obtained this two BTC tx used to fund some of the attackers address http://btc.blockr.io/tx/info/64793d565a20564731671d3ec454fac227f9a709ac278816664a518d3efdcf98
If you care to carry on investigating let me know if I can be of any help
Nice. I've added your comment to the linked post. I'm writing some scripts to automatically collate the data, but short of time over the next few weeks so my analysis will take a while to complete.