The hackers who conducted the massive Twitter hijacking on July 15 do not appear to be sophisticated Bitcoin (BTC) users, as they left trails leading to and from major exchanges that presumably hold the keys to their identities.
The Bitcoin address that hackers used to solicit illicit donations is bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh. A couple of hours into the hack, the perpetrators started moving Bitcoin into other addresses. The Bitcoin trail they are leaving behind suggests that they are not terribly sophisticated when it comes to blockchain technology. They are reusing the same addresses, they are not covering their tracks from and to exchanges sufficiently enough. They have barely used any mixing services.