Over $20 million in stablecoins and Ethereum was moved from a wallet seized by the U.S. government on Thursday. This transfer involves assets linked to the 2016 Bitfinex hack. An on-chain analyst suggests this could be a case of theft.

Some of these funds have found their way to instant exchanges. One of them sources liquidity from Binance, the largest crypto trading platform in the world.

Just minutes before the transfers, Arkham Intelligence, a blockchain analytics firm, tweeted about withdrawals from the lending protocol Aave. Interestingly, this was the first time those funds had been accessed in eight months.

According to Arkham, $1.25 million in Tether was withdrawn from Aave, along with $5.5 million in USDC. These funds were sent to a wallet starting with “0x348.” This wallet also received $446,000 in Ethereum and $13.7 million in aUSDC, which is an interest-bearing token representing USDC deposited in Aave.

Two years ago, the government-controlled wallet received millions in aUSDC. On the same day, it also got a significant amount of the equivalent Aave-based token for Tether.

ZachXBT, a blockchain investigator, called the activity “nefarious” on Twitter. He believes the funds likely stem from theft.

The Bitfinex hack in 2016 was carried out by a married couple from New York City. They later pleaded guilty to money laundering conspiracies. Authorities seized $3.6 billion worth of digital assets from Ilya Lichtenstein and Heather Morgan, as noted in a Department of Justice press release from August 2023.

When asked if the transfers were related to law enforcement, the DOJ did not immediately respond to Decrypt’s request for comment.

The wallet that received the seized funds used 1inch, an exchange aggregator, to swap stablecoins for Ethereum. Then, it began sending Ethereum in $40,000 chunks to a Binance deposit address. ZachXBT flagged this as suspicious.

As of now, $320,000 worth of Ethereum has been sent to an exchange. Additionally, $80,000 worth of Ethereum has been split into other wallets. ZachXBT clarified that the transfers to Binance might not have gone directly to the main exchange. They likely went to a “nested exchange” that uses Binance for liquidity.

The wallet “0x348” made its first transaction less than a week ago. The wallet that funded it received its initial funds two years ago from CoinSpot, an Australian cryptocurrency exchange that operates only in its home country.

Currently, the government-controlled wallet is nearly empty. All its assets are gone, except for $127 worth of a meme coin themed around Donald Trump.