According to data from OKLink, the address involved in the KuCoin theft event transferred 10,000 LINK to an address starting with 0xc1 at 08:38 UTC, which then uses Kyber to trade LINK into ETH again.