A wallet address associated with the multimillion-dollar alleged hack on crypto exchange FTX a day after it declared bankruptcy has moved a portion of the funds to five different addresses.

According to blockchain data picked up by Spot On Chain, the address in question has transferred $17 million worth of ETH since Sept. 30. 

The exploiter’s address sent $13 million to the blockchain token bridge Thorchain’s router and privacy tool Railgun’s smart contract, and swapped $4.19 million ETH for tBTC, a tokenized version of Bitcoin.

Around 12,500 ETH worth $21 million still sits in the hacker’s wallet, but the total estimated loss from the hacking event stands at $323 million, based on statements made by FTX’s interim CEO in charge of bankruptcy proceedings John J. Ray III at the time.

The activity over the weekend was the first time the FTX exploiter has moved funds since the exchange was hacked over two months ago. The movement of funds also comes just days before the trial of former FTX CEO Sam Bankman-Fried is set to commence. 

Earlier this year, Bankman-Fried’s defense team disclosed that they planned to argue that he was acting in “good faith” by loaning funds to Alameda executives, and setting Signal messages to auto-delete under the advice of attorneys at Fenwick & West. 

On Sunday, the judge overseeing Bankman-Fried’s trial ruled that his lawyers cannot make the case that the former FTX CEO was acting under the direction of his legal counsel at FTX’ former law firm Fenwick & West in the defense’s opening statement.

Prosecutors at the U.S. Department of Justice also intend to call former FTX employees, investors and customers of the exchange to testify against Bankman-Fried, according to court documents filed on Saturday.