An Ethereum address linked to the HashFlare cloud-mining fraud transferred 10,600 ETH worth about $18.5 million on Monday morning after sitting idle for roughly three and a half years. Blockchain investigator ZachXBT flagged the movement, the first activity tied to the address since the long-running Ponzi scheme collapsed.
The funds left wallet 0xff575a22975cc413771825eb84c163189a4d5d22 in a single transaction and split across two new recipient addresses, according to ZachXBT's Telegram post early Monday. ETH traded around $1,754 at the time of the move, per CoinGecko. The investigator credited security firm Cyvers with first flagging the unusual flow.
After the initial transfer, the operator began converting ETH to Bitcoin through cross-chain swap services, including Near Intents, that route trades without requiring an exchange account. ZachXBT described the path as routing the ether through "two instant exchanges" before reaching Bitcoin. That conversion pattern, ETH bridged to BTC via instant swaps, is the same flow ZachXBT documented in several recent laundering runs, including the KelpDAO exploit aftermath and a $120 million USDT trace earlier this month.
The address had received its ETH balance in late 2022 and held it through the entire prosecution arc, including the founders' February 2025 guilty pleas and August 2025 sentencings. Onchain trackers had publicly labeled it for years without intervention from law enforcement.
