The exploiter has cashed out over $4 million including about 1,400 ether, one million DAI and 90 WBTC.
Italian police said the Florence-based man is either behind the breaches or took no action after the first attack came to light.
The activity was first noticed in November, according to the report.
The cyberhackers used bitcoin to cover their ties to critical hacking campaign "infrastructure" such as servers and domain names, according to an indictment unsealed Monday by U.S. prosecutors.
The exchange's weekend thieves appear to be searching for buyers of their $281 million in stolen crypto.
