Data from blockchain services company Coinfirm shows that the perpetrators of the Binance hack are moving small amounts of stolen funds into multiple addresses to avoid detection.