Exchanges ShapeShift and Changelly cooperating with police after it emerged that the WannaCry attackers used it to convert Bitcoin to Monero.

As multiple sources report, the fairly modest sums the hackers gained from the international cyberattack have made their way through the two exchanges for the equivalent in Monero (XMR). The altcoin is regarded by some to offer more anonymity than other cryptocurrencies.

“As of today, we have taken measures to blacklist all addresses associated with the WannaCry attackers that are known to the ShapeShift team, as is our policy for any transactions we deem breach our terms of service,” a statement from the exchange reads Thursday.

“We are closely watching the situation as it continues to unfold as to block any further addresses associated.”

Changelly told Cointelegraph that more than 5.2 BTC had moved through its exchange, and that it was cooperating with Europol on the issue.

North Korea involved?

The details behind WannaCry are still hazy, with the latest suspicions falling on state-sponsored actors working on behalf of the North Korean government. Previous investigations suggested the perpetrators had Chinese as their first language.

“Any transactions made through ShapeShift can not be hidden or obscured and are thus 100 percent transparent, making laundering of any digital tokens impossible,” ShapeShift continued about the trade itself.

Despite the widespread havoc wrought by the attack, only a relatively small amount of Bitcoin was sent as ransom money, and the progress of the funds is being keenly tracked by the community.

Transaction mapping tool BlockSeer released a physical representation of how the coins moved through ShapeShift and Changelly, which it published on Twitter in light of the trade.