Remember that the person/people who pulled off this inside job had access to everything belonging to FTX - wallets, private keys, servers, websites, apps, source code, the lot. They would certainly have had access to transaction histories, and so could simply have picked the Kraken account of an unsuspecting FTX user to send some of the stolen funds to in order to throw people off the scent.
[/quote]
Good point. Thinking of it, they could even frame another FTX employee that they know has Kraken account and has access to everything needed, which would make him an obvious target.