Good point @reginold I am not familiar with Ether but if it's a cold wallet, you are right. If Ether is like Bitcoin and addresses can be derivations, would using these be enough to conceal the overall lack of return transactions?

Speculation: they likely jump wallets so in case a victim gets curious and checks the address they won't notice that there are never "double" transactions sent back.

Open to other ideas! Looks like they switch every hour or so.

In terms of "blocked as they go", afaik there's no way to "block" a wallet, so that's not the reason.