The subject here is the 400K address connected to gox's proven 424K address.
Many of the transactions out of bitcoin2cash's advertised public address (later became localbitcoins) ended up at the 400K address. I suspect it was people who bought bitcoin from bitcoin2cash and then sold on gox. You can see 25K was received by someone then 1 day later sent to a likely gox wallet where it got consolidated into the 400K: https://blockchain.info/address/16GJ6iK1S2R8XV4tjwbRzvThUUQTXYqrhW
If the 400K address is gox then the bitcoin days destroyed spikes on Dec 21 and Feb 5 (day before gox disabled withdrawals) totaling ~160K were all gox chunks. You can see they have a similar pattern where 0.001 BTC is sent to test if the new address works, then the full 4K chunk is sent to its final resting place. This can't be tx malleability because on Feb 5 a hacker returning the 0.001 test back into the gox wallet before doing the full 4K withdrawal makes no sense:
chunk from Dec 21 spike: https://blockchain.info/address/1La6D1DR7CgbysSubCJD65c5T1FSrRJFjZ
chunk from Feb 5 spike: https://blockchain.info/address/14YarNeVKHSoq7Tp4P51yc4Y94EXhdfQL5
Further evidence that the days destroyed spikes were gox: Bitcoin donated to gox (their advertised address) gets consolidated into 9K, then 45K:
Then the 45K gets split up into 4K chunks, which went untouched until the Feb 5 spike!
Here's a 9K chunk split off from the gox donations where on Feb 5 you see the typical 0.001 test to see if the new address works, followed by a return of the 0.001, followed by the full withdrawal:
and the final resting places of the 9K chunk (2K+7K):
Once the 9K was moved out of cold storage we see a 0.001 cleanup on the hot 9K address which reveals gox's major hot wallet!
The hot wallet is a 15K chunk, backtracing it leads to gox's 400K. You can see it was being siphoned off daily in 500 BTC chunks which were further distributed until withdrawals were disabled Feb 6. It became active again several days ago for the final cleanup where the hot wallet currently resides (15K+500):
On Feb 5 Karpeles resurrected cold storage to handle withdrawals but then thought “screw it!” He's tired of getting bashed by the community so he used some minor tx malleability theft as an excuse to declare bankruptcy. I believe he also sold 10K BTC on bitstamp before announcing his resignation but I have no proof. This is a massive fraud! Karpeles thinks he's bullet proof hiding behind corporate liability protection and lack of regulation.