They might've been in the process of transferring crypto silently for months and only now had to rush overtly enough to be spotted.