Bitcoin2cash
Evidence that Karpeles still has the coins
Many of the transactions out of bitcoin2cash's advertised public address (later became localbitcoins) ended up at the 400K address. I suspect it was people who bought bitcoin from bitcoin2cash and then sold on gox. You can see 25K was received by someone then 1 day later sent to a likely gox wallet where it got consolidated into the 400K:
Edit: The owner just confirmed it's a gox deposit address!
If the 400K address is gox then the bitcoin days destroyed spikes on Dec 21 and Feb 5 (day before gox disabled withdrawals) totaling ~160K were all gox chunks. You can see they have a similar pattern where 0.001 BTC is sent to test if the new address works, then the full 4K chunk is sent to its final resting place. This can't be tx malleability because on Feb 5 a hacker returning the 0.001 back into the gox wallet before doing the full 4K withdrawal makes no sense:
chunk from Dec 21 spike:
chunk from Feb 5 spike:
Then the 45K gets split up into 4K chunks, which went untouched until the Feb 5 spike!
Here's a 9K chunk split off from the gox donations where on Feb 5 you see the typical 0.001 test to see if the new address works, followed by a return of the 0.001 to test sending from the address, followed by the full withdrawal:
and the final resting places of the 9K chunk (2K+7K):
Once the 9K was moved out of cold storage we see a 0.001 cleanup on the hot 9K address which reveals gox's major hot wallet!
The hot wallet is a 15K chunk, backtracing it leads to gox's 400K. You can see it was being siphoned off daily in 500 BTC chunks which were further distributed until withdrawals were disabled Feb 6. It became active again several days ago for the final cleanup where the hot wallet currently resides (15K + new 500 chunk):