I'm not sure how accurate that 28 BTC input/output # actually is. ((but I'm a blockchain novice, so this summary is my best assumption))
When looking at the blockchain.com transaction log, I see:
The first transaction looks like it was the .0001BTC that VPN sent as a test transaction with hash ID <935dc7ef6f55ee0cd4a1159ef367324824ef1ccf239019154672e1630 cdaa81b>
Blockchain.com seems to list 6.91589205 BTC as outPut but the wallet in question looks to only have received the .0001BTC input.
((ie. the BTC output may equal 28 BTC, but it doesn't look like the wallet actually received that amoiunt))
When I first took a stab at looking at the chain history, I used:
https://www.blockonomics.co/#/search?q=bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr
It looks like:
4 May 2022 @1205: received:
+0.0001 BTC
4 May 2022 @1246: received:
+6.27 BTC
11 May 2022 @2128: sent
-0.50002679 BTC
11 May 2022 @2138: sent
-0.50002679 BTC
11 May 2022 @2233: sent
-1.00002679 BTC
11 May 2022 @2255: sent
-1.00002679 BTC
12 May 2022 @0011: sent
-1.00002736 BTC
12 May 2022 @0057: sent
-1.00002592 BTC
12 May 2022 @2143: sent
-1.26993956 BTC
Show attachment 228586
**(time stamps from blockchain.com | hyperlinks to blockonomics.co)
*** Notably, the transaction times on Blockchain.com and Blockonomics.co are a few minutes apart, so take the transaction times with a grain of salt
...
11 May 2022 @2128: sent
-0.50002679 BTC >> looks to have been sent to wallet address:
bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j
Show attachment 228587
bc1qfu465pdlg5yfkdmq5nvkmehngzpxvgraam2x4j (address history)
Show attachment 228589
Looks to have been emptied to wallet address:
14FoANzjfuzx5kjcE2t9RHu5GyF21EDgwF
...
11 May 2022 @2138: sent
-0.50002679 BTC >> looks to have been sent to wallet address:
bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc
bc1qky0tpy908awklx78yczq3krg5f284ze3g6qarc (address history)
Show attachment 228591
Looks to have been emptied to wallet address:
bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn
...
11 May 2022 @2233: sent
-1.00002679 BTC >> looks to have been sent to wallet address:
bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg
bc1qz326c2yjfhmn2hh8vdpa5h5fe09gwu5v53atrg (address history)
Show attachment 228592
Looks to have been emptied to wallet address:
bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or maybe
16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW
...
11 May 2022 @2255: sent
-1.00002679 BTC >> looks to have been sent to wallet address:
bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj
bc1qs5q5qeclklgn8j2lqkncjztp34tzjnxafyh8lj (address history)
Show attachment 228593
Looks to have been emptied to wallet address:
bc1qrgdndftdm03kkdzs3crm85ter8prdcv5qgg5nn or
16hiTVsDsGJun1ZiufqPyVw9fbaWbeykQW
...
12 May 2022 @0011: sent
-1.00002736 BTC >> looks to have been sent to wallet address:
19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc
19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
Show attachment 228594
Looks to have been emptied to wallet address:
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
...
12 May 2022 @0057: sent
-1.00002592 BTC >> looks to have been sent to wallet address:
19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (same address as above)
19apZEZjdXQpVH9GJnwCJiaccXXgfLXvrc (address history)
Show attachment 228594
...
12 May 2022 @2143: sent
-1.26993956 BTC >> looks to have been sent to wallet address:
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y (address history)
Show attachment 228595
Looks to have been emptied to wallet address:
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC
Needless to say, all addresses that received BTC directly from the BTC address that VPN sent 6.2701 BTC to appears to have been emptied.
However, you can see the destination wallet address that these were emptied to. I didn't post some active wallets I found earlier because I don't know how to confirm or make sense of these transactions when these coins enter wallets with lots of activity.
For instance, take a closer look at the final transaction, <12 May 2022 @2143: sent -1.26993956 BTC>
The transaction input was:
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
1.26983956 BTC
bc1qymcdwgqde47qxd8s7tk0jyufpgejrgtg4gw5qr << that's the address alleged Dikian provided VPN>
0.0001 BTC
The transaction output was:
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y <<that's the gaining address>
1.26989974 BTC
The gaining wallet address <
127ygKZgJXDDk7g3mcUuEyrqRQ2MzXfF4Y> then
sent its remaining 1.269.. BTC to address <
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC>
The BTC Wallet Address <
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> appears to have a BTC balance of 2659 BTC (= current value of apprx $47million)
In summary (for instance), VPN sent 6.27 BTC to alleged Dikian wallet > the alleged Dikian wallet sent the remaining apprx 1.269 BTC to wallet ending in XfF4y > the wallet ending in XfF4y looks to have been emptied to wallet ending in 5kmqC > wallet ending in 5kmqC appears to have a current balance 2659 BTC, albeit with lots of incoming/outgoing transaction history..
I have no idea how to identify the wallet <
1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC> which has a $47mllion BTC balance... is it an exchange? a mixer? or...?