During the tracing of the $11 million ransom payment, authorities identified a transaction chain where the attackers attempted to obfuscate funds through a series of complex transactions. This step involved multiple Bitcoin addresses and associated transactions, analyzing the flow and linking it to known malicious actor wallets.