as i investigate old transactions posted at their fb group. i discovered that some of the transactions routed on this wallet address.

1. 0xF9C1134AdB43d180634C05ABc7E47Fd9461a5Dfb
2. 0x51836A753E344257B361519E948ffCAF5fb8d521

some of big eth transactions were transferred to bittrexx and etherdelta so im guessing he is trying to hide all the money to his new accounts