Wallet transactions camouflage the IP address of the botnet's control server.
The text above is a summary, you can read full article here.