A Reddit user investigating Bitcoin withdrawals from Canada’s now-bankrupted cryptocurrency exchange QuadrigaCX has found out that some of them had come from other exchanges – one from a HitBTC hot wallet and the other from a Bittrex hot wallet to be exact.

In a Reddit post, user u/cheeky2u also stated that he had discovered various addresses appearing on several High Yield Investment Programs (HYIP), malicious ransomware research, as well as a separate post by another Reddit user regarding lost funds.

Upon closer inspection, the discovery of these seemed to suggest to u/cheeky2u that crypto had been previously sent from exchanges to fund HYIP Ponzi schemes, while hackers tried to cash in what they earned through ransomware on those exchanges.

u/cheeky2u’s findings seem to be in line with an earlier theory put forth by consulting platform ZeroNonCense, which said last month that based on research it believes there is a “very strong possibility” an accumulated total of 649,708 ETH was sent to Kraken, Bitfinex, and Poloniex directly by QuadrigaCX. At the time, ZeroNonCense highlighted this “does not imply that there was any nefarious intent behind the transfers or that these exchanges are in collusion with one another”.

QuadrigaCX filed for creditor protection in compliance with the Companies’ Creditors Arrangement Act (CCAA) on February 1, following its founder’s sudden death in December 2018. It was formally ruled as bankrupt by the Canadian court earlier this month, reported TheCryptoSight, just days after its court-appointed monitor Ernst & Young said the exchange should be placed in bankruptcy instead of being restructured as originally planned.