I'd agree, 2.8m showing up in accounts will always trigger flags; there's just no way to avoid someone asking questions at that level.
Saying Crypto isn't enough which is why he tried to say it was a 'family member gift' which he couldn't prove. Probably all he could show was that his currency came in from a mixer which is going to raise questions.
I'm surprised he didn't simply hold tether (if he wanted stable) and then drip it into his accounts.