Over $20 million worth of stablecoins and Ethereum was transferred from a wallet containing funds seized by the U.S. government Thursday, shifting assets tied to the 2016 hack of the crypto exchange Bitfinex to a five-day-old address in what an on-chain analyst is framing as a likely theft.

Some of those funds have now been moved to so-called instant exchanges, including one that sources its liquidity from Binance—an off-shore exchange and the largest crypto trading platform in the world by volume.

Minutes before the transfers took place, the blockchain analytics firm Arkham Intelligence highlighted withdrawals from the lending protocol Aave in a tweet. It was the first time the funds had been touched in eight months, the company said.

According to Arkham’s platform, $1.25 million of the stablecoin Tether was withdrawn from Aave as well as $5.5 million of USDC. Those funds were subsequently sent to a wallet beginning “0x348” alongside $446,000 worth of Ethereum and $13.7 million of aUSDC, an interest-bearing token that represents USDC deposited in an Aave lending market.

The government-controlled wallet received millions of dollars of aUSDC two years ago. On the same day, it also received a hefty sum of the equivalent Aave-based token for Tether.

The pseudonymous blockchain sleuth ZachXBT said the activity appeared “nefarious” on Twitter. Most likely, the funds were flowing as a result of “theft,” the sleuth added.

Bitfinex was hacked in 2016 by a married couple from New York City, who later pleaded guilty to money laundering conspiracies. Taking advantage of a security breach at the exchange, Ilya Lichtenstein and Heather Morgan had $3.6 billion worth of digital assets seized by the authorities, according to a Department of Justice (DOJ) press release from August 2023.

Asked whether the transfers were conducted in relation to law-enforcement activities, the DOJ did not immediately respond to a request for comment from Decrypt.

The wallet that received millions of dollars of government-linked funds Thursday proceeded to use 1inch, an exchange aggregator, to swap stablecoins for Ethereum. It then began shuffling Ethereum in $40,000 chunks to a deposit address for the crypto exchange Binance, which ZachXBT flagged as suspicious behavior.

In total, $320,000 worth of Ethereum had been sent to an exchange, as of this writing. At the same time, $80,000 worth of Ethereum had splintered off into other wallets. In a comment, ZachXBT clarified that the transfers to Binance weren't necessarily sent to the leading crypto exchange. Rather, they appeared to be sent to a so-called "nested exchange," which uses Binance as a source of liquidity.

When it comes to “0x348,” the wallet made its first transaction less than a week ago. And the wallet that funded it received its first funds two years before from the Australian cryptocurrency exchange CoinSpot, which does not operate in any other jurisdiction.

As of this writing, the government-controlled wallet was virtually empty. All of its assets were gone, aside from $127 worth of a Donald Trump-themed meme coin.

Edited by Andrew Hayward

Editor's note: This story was updated after publication to clarify the context around transactions that appeared to interact with Binance.