Blockchain security firm Cyvers said the KyberSwap exploiter’s acquired funds were spread across various externally owned accounts (EOAs), now recognized as the top HXA token holders.