The hacker behind the bankrupt cryptocurrency exchange FTX started transferring their Ether (ETH) holding to a new wallet address on Nov. 20. The FTX wallet drainer was the 27th largest ETH holder after the hack but dropped by 10 positions after the weekend ETH dump.

The FTX hacker drained nearly $447 million out of multiple FTX global and FTX US exchange wallets just hours after the crypto exchange filed for Chapter 11 bankruptcy on Nov. 11. Majority of the stolen funds were in ETH, making the exploiter the 27th largest ETH whale.

On Nov. 20, the FTX wallet drainer 1 transferred 50,000 ETH to a new address, 0x866E. The new wallet address then swapped the ETH for renBTC (ERC-20 version of BTC) and bridged to two wallets on the Bitcoin blockchain. One of the wallets bc1qvd…gpedg held 1,070 renBTC while another wallet bc1qa…n0702 held 2,444 renBTC.

Crypto analytic group CertiK later tracked the bridged renBTC on bc1qvd…gpedg address and found that the address employed a money laundering technique called peel chain to launder the renBTC.

A Peel chain is a technique to launder a large amount of cryptocurrency through a lengthy series of minor transactions. A small portion is “peeled” from the subject’s address in a low-value transfer. These incremental laundered funds are often transferred to exchanges where they can be converted to fiat currency or other crypto assets.

Related: FTX hacker is now the 35th largest holder of ETH

At the time of the FTX hack, there were two parties involved, one black hat that managed to drain $447 million and a white hat that managed to move $186 million of FTX assets to cold storage. However, when Bahaman Securities and Exchange Commission released a notice suggesting they are trying to move assets from the FTX, it raised many eyebrows, with many claiming that the securities regulator was, in fact, the black hat behind the exploit.

On-chain analyst ZachXBT highlighted the token transfer pattern of the black hat wallet and said that the wallet was dumping tokens and bridging sporadically was a very different behavior from the other addresses that withdrew from FTX and instead sent to a multisig on chains like Ethereum or Tron.

Looking at the movement of funds and the techniques involved in the transfer of these funds, t’s unlikely that FTX wallet drainer 1 is under the control of the Bahamian government based on today’s on-chain activity. The BTC activity is consistent with a peel chain, a form of money laundering that would be highly unusual for a government agency to be involved in.