Roughly 10,600 ETH worth about $18.5 million, has moved from an address linked to the $577 million Hashflare fraud after 3.5 years of dormancy and is already being laundered into Bitcoin, on-chain investigator ZachXBT said.
On June 22, 2026, at 7:33 AM UTC, the 10,600 ETH left a wallet tied to the Hashflare Ponzi scheme, breaking three and a half years of on-chain silence. Zach credited blockchain security firm Cyvers with first flagging the movement and published the trail, including the Hashflare-linked source address (0xff575a…5d22) and a recipient address (0xc82f00…9d04).
The funds did not sit still. According to ZachXBT, the entity began converting the ether into Bitcoin through HiFiSwap and the cross-chain tool Near Intents while routing capital through two instant exchanges—services that swap one asset for another without identity checks. The pattern matches a laundering signature ZachXBT has mapped repeatedly this year, in which funds are split across bridges and swap layers to break the trail between money and its origin.
A $577M Ponzi, a forfeiture, and a sentence under appeal
The dormancy ending now is what gives the movement weight. Hashflare was an Estonian cloud-mining operation that, between 2015 and 2019, sold more than $577 million in contracts promising a cut of mined crypto. Prosecutors said it never had the hardware to perform most of that mining — roughly 164 working machines against the 80,000 it would have needed — and showed customers a dashboard built on falsified numbers. The founders, they said, spent investor money on real estate, luxury vehicles, and more than a dozen chartered private-jet trips.
Co-founders Sergei Potapenko and Ivan Turõgin, arrested in Estonia in 2022 and extradited in 2024, pleaded guilty to wire fraud conspiracy in February 2025. At sentencing, more than $450 million in cryptocurrency, funds, and equipment was forfeited toward compensating roughly 440,000 victims, around 60,000 of them in the U.S. The two received time served—a sentence the Justice Department is appealing to the Ninth Circuit, having sought 10 years.
That backdrop sharpens the question the movement raises: whether assets connected to the scheme sat outside the forfeited pile and are only now being moved while victim remission remains pending and the case is unresolved on appeal.
Routed into Bitcoin, beyond a freeze
The choice of exit is itself telling. By converting ether into Bitcoin rather than a stablecoin, whoever controls the funds steps outside the one enforcement lever that has defined this year’s laundering crackdowns. Tether can blacklist a USDT address at the contract level, locking funds in place; it has frozen more than $4.4 billion in USDT across 2,300-plus cases. Bitcoin has no issuer and no equivalent kill switch; once value lands there, no company can freeze it.
That makes the ETH-to-BTC route a deliberate hedge against the freeze net that snared launderers in cases ZachXBT himself helped trigger. Instant exchanges and Near Intents add further distance, converting and moving the funds faster than most compliance desks can react.
Who controls the funds remains unknown
A crucial caveat runs through the trace: ZachXBT links the source address to the Hashflare fraud but has not identified who controls it. The funds could be held by a figure connected to the scheme, an associate, or a third party who acquired tainted coins years ago. Nothing in the public on-chain record ties the movement to the convicted founders, who are on supervised release in Estonia.
What is established is the pattern, dormant fraud-linked capital reactivating and immediately entering a laundering flow, and that an independent analyst, not law enforcement, surfaced it in real time. Whether the funds get frozen at an off-ramp, traced further, or vanish into Bitcoin will be the next test.
