And then from 3FeGz3AivG9SUEPKcGASh4ZcD9JojUjHSL it started splitting to smaller amounts to different addresses - looks like mixer or so...
So if 3ALZ4ALw2T4jebXXUy8GMv2rLB7JpFL1JD and 12YBZCaPe45LFbvgYWP5AVm3pvZTtHTiNY are really Cryptopias then it looks very suspicious - what if 3FeGz3AivG9SUEPKcGASh4ZcD9JojUjHSL belongs to the "hacker" and BTC were stolen too?