On-chain data shows the $4.5 million was first transferred from the Kraken crypto exchange, before eventually arriving at an address purportedly owned by a scammer.