Are you sure address 3 had 6.5235 btc in it at that time? I am seeing only 5.50119801 in it at this time. 🙃
Maybe some transactions got double spent / dropped?
Although who the heck would pay ransomware from the start when they know to double spend?!