A wallet linked to HashFlare became active again after about 3.5 years, moving 10,600 ETH valued at roughly $18.5 million. Published on-chain data shows the funds were first split between two recipient addresses and then routed through HiFiSwap and Near Intents, with part of the assets already being exchanged from Ethereum into Bitcoin.
The activity was first flagged publicly by on-chain investigator ZachXBT and blockchain security firm Cyvers. Investigators said the withdrawal can be traced to address 0xff575a22975cc413771825eb84c163189a4d5d22, with transaction ID 0xd0eafd5c03b24c2f54c579745cacbffe4c6df2d19973e55d52a5f40aa1d89e0. The path of the funds is visible on-chain. The reason behind the timing has not been disclosed in the report.
Funds were split and routed toward Bitcoin
According to the published findings, the 10,600 ETH was distributed to two addresses before being processed through instant swap platforms. Analysts said available evidence points to a partial conversion from Ethereum to Bitcoin. The report did not specify how much of the total has already been swapped, nor did it identify a final consolidation address.
The transfer drew attention because of both its size and its connection to the long-running HashFlare case. That case has remained in focus even after guilty pleas and sentencing.
HashFlare raised more than $577 million, court records say
HashFlare launched in 2015 as a cloud mining business that sold contracts promising customers a share of crypto mining revenue. Court records cited in the report say the company raised more than $577 million from around 440,000 investors worldwide between 2015 and 2019.
Legal filings said the company never had the computing power it advertised. Instead, the operation reportedly ran at only about 1% of its claimed Bitcoin mining capacity, while customer dashboards displayed fictitious performance figures and earnings that did not exist. U.S. prosecutors described the mining activity shown to investors as a mirage.
When customers tried to withdraw funds, the founders allegedly bought Bitcoin on exchanges to cover those payments. Prosecutors said that turned the business into a Ponzi-style fraud in which newer deposits were used to satisfy earlier obligations. The same filings also accused Sergei Potapenko and Ivan Turõgin of spending investor money on real estate, luxury cars, high-end jewelry, and private jet travel. A separate venture run by the pair, Polybius, raised at least $25 million with a promise to build a blockchain-based bank, but the report says it produced neither an operating bank nor dividend payments.
Appeal remains active after sentencing
In February 2025, Sergei Potapenko and Ivan Turõgin pleaded guilty to conspiracy to commit wire fraud. U.S. District Judge Robert S. Lasnik sentenced both men to 16 months in prison, with pre-trial detention counted toward the term. Each was also fined $25,000, ordered to complete 360 hours of community service, and placed on three years of supervised release in Estonia.
Federal prosecutors had asked for 10-year prison terms for both defendants. In late August 2025, they filed a formal appeal arguing the punishment was too light. The report also said victims expect full compensation from more than $400 million in seized assets under the plea deal, though the U.S. Department of Justice has not announced a distribution schedule.