Hackers apparently still have control over New Zealand-based cryptocurrency exchange Cryptopia.

Blockchain data analytics firm Elementus said in a blog post Tuesday that Cryptopia’s hacker, after going quiet for some days, has stolen an additional 1,675 ether from 17,000 wallets – an amount worth about $181,000 at the time of writing.

While initially it looked like Cryptopia might be moving cryptocurrency to secure the remaining user funds, the ether were being sent to an ethereum address used by the hacker previously, said the firm, adding:

“The hacker has the private keys and can withdraw funds from any Cryptopia wallet at will.”

Elementus also said that some wallets are still being topped up, suggesting that not all users know of the breach.

“Most of the funds are coming from mining pools,” the firm added. “Presumably, these payments are being sent on behalf of miners who opted to receive their rewards automatically via ‘direct deposit,’ and have since forgotten about it.”

Last week, Elementus published another analysis indicating that about $16 million worth of ether and ERC-20 tokens had been stolen from Cryptopia wallets.

The exchange, though, hasn’t released any information on the amount of loss to date. It went offline on Jan. 15 citing a major hack that resulted in “significant losses.”

Since then, New Zealand Police has been investigating the case, stating that it is keeping an “open mind” on the possibilities.

On Jan. 22, the police issued an update saying that “good progress” is being made and “positive lines of enquiry are being developed to identify the source of the transfer, and to identify where the cryptocurrencies have been sent.”

Hand on keyboard image via Shutterstock