I believe changenow is a binance-backed scam .
Their hot wallets are all stored in binance .
Binance may not be backing the scam parse, but the most likely scenario is Changenow.io maybe using them as their Liquidity partners. That why you might see the deposited funds ending up in some Binance's Hot wallet.
I don't if Binance will be helpful to you in pursuing this case, but you will certainly need something like a court order and some help from law enforcement before you even get started.