The project was $1M+ which was enough for prison time. He had gone into our billing software and edited my entries - it wasn't as if he was submitting the fraudulent totals only - he was changing what I was entering.
I gathered as much documentation as I cloud and went to a law firm. They told me I had two options - report it to the Government Accounting Office or report it to the head of the project, an academic.
So I simultaneously resigned and reported it to the professor. I covered my butt. I'm pretty sure the professor hid the fraudulent billing but I didn't look into afterwards because basically that was what I was hoping he'd do so I wouldn't have to go to court and defend that my reported hours weren't really mine.
The full project was eventually awarded to another academic group.