The person behind the FTX exploit has been converting significant amounts of Ethereum to Ren Bitcoin,  a tokenized form of Bitcoin on the Ren protocol.

On Sunday, the FTX drainer wallet moved $29.3 million worth of ETH through the Ren: BTC Gateway, according to data from blockchain security firm PeckShield.

Last week, the FTX exploiter began a massive ETH buying spree by exchanging millions of stolen tokens for ETH. At one point, the exploiter’s address was one of the largest ETH holders in the world with a balance of $285 million worth of the cryptocurrency. Now, it looks like the attacker is preparing to cash out.

On-chain data platform Chainalysis shared an image of the series of transactions documenting the hacker’s movement. According to the firm, these funds were likely bridged from ETH to BTC as a step before a cash out attempt.

On Nov. 18, chaos ensued after FTX debtors said in an emergency motion that the Bahamas regulators asked Bankman-Fried to transfer the exchange’s crypto balance to the government’s digital wallet. The Bahamas Securities Commission later confirmed that they had indeed made an order of this nature, leading many to the conclusion that the Bahamas government was in custody of the stolen funds.

“Reports that the funds stolen from FTX were actually sent to the Securities Commission of The Bahamas are incorrect. Some funds were stolen, and other funds were sent to the regulators,” tweeted Chainalysis on Sunday.

The firm cautioned exchanges to be on “high alert” to freeze funds if the exploiter attempts to move them on to an exchange

The use of the Ren Bridge to transfer assets is interesting given that the protocol said in February 2021 that its development team would be acquired by Alameda.

At the time, Ren CEO Taiyang Zhang said that the team was excited to be working with Sam Bankman-Fried and the Alameda team to develop more support for Solana and bring more volume to RenVM.

On Nov. 19, Ren said it was “moving on from Alameda” and is now seeking additional funding in light of the FTX Group’s bankruptcy proceedings. The Ren development team anticipates its funding will run dry by the end of Q4.