The flow of funds can be simplified as follows:
Victim’s wallet → malicious smart contract / attacker’s address → several intermediate addresses → exchange, DEX, or other service.
This is precisely where blockchain can be very useful. The movement of funds can be publicly tracked using a blockchain explorer. However, this does not automatically mean the perpetrator's true identity can always be uncovered—while addresses and transactions can be traced, the person controlling them cannot necessarily be identified.
Therefore, I will certainly include a practical case study in a future lesson, demonstrating step-by-step how to spot a suspicious transaction, what "approvals" mean, and how to safely track the flow of funds on the blockchain.