Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?

Question

The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89.

The (formatted) payload of the first transaction was:

0xc4463c80
000000000000000000000000000000000000000000000000000000000000003b
000000000000000000000000b656b2a9c3b2416437a811e07466ca712f5a5b5a
000000000000000000000000f835a0247b0063c04ef22006ebe57c5f11977cc4
0000000000000000000000000000000000000000000000000000000000000009
000000000000000000000000f35e2cc8e6523d683ed44870f5b7cc785051a77d

There seems to be some accounts in the payload that are:

• Account 0xb656b2a9c3b2416437a811e07466ca712f5a5b5a
• Contract 0xf835a0247b0063c04ef22006ebe57c5f11977cc4
• Account 0xf35e2cc8e6523d683ed44870f5b7cc785051a77d.

The destination contract for the hacked ethers is 0x304a554a310c7e546dfe434669c62820b7d83490 currently holding 3,641,694.241898506 Ether ($52,403,980.14).

In particular, which accounts used in the attack are under control of the attacker?

Some further information:

• The first transaction used to mount the attack was 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b as listed in Is there any way to determine how long it took for the DAO attacker to deploy the attack?
• Here is a .zip of the debug.traceTransaction(...) of the first of the attacker's transaction - TheDAORecursiveCallAttack-FirstTransactionDebug.txt.zip.

Answer 1

As pointed out in @Ismael's comment in Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, there is some nice analysis in progress at The rise of the Dark DAO.

From the article, the following accounts may be involved:

Useful information

Creator of the malicious DAO: 0x4a574510c7014e4ae985403536074abe582adfc8

Start of the drain: 2016–06–17 03:34:48 UTC, block 1718497

The malicious child DAO aka “The Dark DAO”:0x304a554a310c7e546dfe434669c62820b7d83490

Malicious token holders aka “Dark token holders”.

These are the accounts that control the malicious DAO:

• 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89

• 0xf835a0247b0063c04ef22006ebe57c5f11977cc4

Curator of the malicious DAO and creator of the malicious proposal:

• 0xb656b2a9c3b2416437a811e07466ca712f5a5b5a

The malicious proposal from which the attack was launched:

#59, aka “lonely, so lonely”, 2016–06–08 05:38:01 UTC, before the recursion call bug went public on 2016–06–10

Voted Yes:

• 0xf835a0247b0063c04ef22006ebe57c5f11977cc4

• 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89

Voted No:

• 0xca8e11c876180c9f2115fa61fe2a1a3a6f66ebaf

• 0x347c28ef5487b37a8e03040653a739f19b986b2d

Recipient as stated in the malicious proposal:

• 0xb656b2a9c3b2416437a811e07466ca712f5a5b5a

EDIT 19/06/2016

To two attacking accounts 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89 and 0xf835a0247b0063c04ef22006ebe57c5f11977cc4 have multiple transfers of 25,805.6141471 DAO tokens, with the final destination account of 0xca04d260356d19f0d7255041542c9cbc866f2cb3.

EDIT 19/06/2016

From the article The attack story by Johannes Pfeffer (with help from @mKoeppelmann and @tayvano):