Hackers who stole ¥58 billion ($532 million) worth of cryptocurrency from the Coincheck exchange last week are trying to move the stolen “XEM” coins, the foundation behind the digital currency said on Tuesday.

NEM Foundation, creators of the XEM cryptocurrency, have traced the stolen coins to an unidentified account, and the account owner had begun trying to move the coins onto six exchanges where they could then be sold, Jeff McDonald said.

The location of the hackers’ account was not known.

“(The hackers are) trying to spend them on multiple exchanges. We are contacting those exchanges,” Singapore-based McDonald said.

NEM Foundation spokeswoman Alexandra Tinsman said the hacker had started sending out coins to random accounts in 100 XEM batches, worth about $83 each.

“When people look to launder these types of funds, they sometimes spread it into smaller transactions because it’s less likely to trigger (exchanges’) anti-money laundering (mechanisms),” said Tom Robinson, co-founder of Elliptic, a cryptocurrency security firm in London.

Robinson said such hopping among different cryptocurrencies was becoming more prevalent among cybercriminals trying to cover their tracks.

The coins that the hackers had taken made up around 5 percent of the total supply of XEM, the world’s 10th-biggest cryptocurrency, according to trade website Coinmarketcap.

McDonald said the hackers were unlikely to try to spend anything close to all of the stolen cryptocurrency at once.

If the hackers successfully moved the coins to an exchange, they were likely to try to swap them into another cryptocurrency before transferring the coins back into a conventional currency, he said. That would make the funds difficult or near impossible to trace.