Or he simple mixed and moved the funds to protect his employer?

I really don't see why you are making a big deal out of this while you still only have circumstantial evidence. It's not like he accepted 20 BTC, which were likely stolen prior to accepting them, from a well known scammer to perform a task, fail to complete it and never repay the funds.