[DigitalToday reporter Jinju Hong (홍진주)] Ethereum (ETH) stolen in the Drift Protocol hack has started moving again. Ethereum worth $32 million moved in a day from hacker-controlled wallets to the cryptocurrency mixer Tornado Cash, drawing attention to possible further laundering and selling.

On Oct. 20 (local time), blockchain media outlet U.Today reported that 13,400 ETH was transferred to Tornado Cash from a wallet controlled by hackers over the past day. It was worth about $32 million at the time.

Onchain Lens and Lookonchain spotted the transactions based on Arkham data. An address analysts classified as "Drift Exploiter 5" was confirmed to have sent funds to the mixer contract. Some analytics platforms, including MistTrack, estimated total daily movement across linked wallets at up to 25,700 ETH, or about $61.5 million.

The movement is drawing attention because hacker wallets that had been quiet for about 2 months have become active again. Hackers are sending funds to Tornado Cash in multiple tranches and are also using transfers in exact 100 ETH units.

Tornado Cash is a mixer service that makes it difficult to trace a fund’s source and path by blending transactions into multiple inflow and outflow streams. If hackers use such a service, it may become harder to identify the final recipient based only on transactions recorded on a public blockchain.

The transaction is known as the second large attempt to launder the stolen funds. In July, hackers moved about $44 million through a mixer in a similar way. Still, the fact that funds flowed into a mixer alone does not mean the entire amount was cashed out or sold.

A substantial amount of Ethereum still remains in hacker wallets. Estimates differ by tracking platform, but balances are put at about 82,000 to 94,000 ETH, equivalent to as much as $224 million. If additional transfers continue, tracking and recovering the stolen funds could become more difficult.

The case began with the Drift Protocol hack on April 1. Drift Protocol, a Solana-based decentralised exchange platform, was attacked at the time and had about $285 million in assets stolen in about 12 minutes.

Blockchain analytics firms TRM Labs and Chainalysis pointed to a North Korea-linked group, UNC4736, as being behind the attack. The group is also known as "Citrine Sleet".

The attack was found to have been prepared over several months. Hackers were reported to have posed as legitimate venture investors, contacted developers at international conferences and built trust by depositing $1 million of their own funds into an exchange liquidity pool. They were later reported to have exploited hidden vulnerabilities in Cursor and VS Code to compromise devices belonging to members of the platform’s security committee and steal admin keys.

During the attack, the perpetrators also used a method in which fake CarbonBot tokens were used like collateral to drain real reserves. Analysts say it was a long-term infiltration operation that went beyond a simple smart contract vulnerability attack, building trust, securing internal privileges and stealing assets.

The movement of stolen funds is also weighing on prospects for victims to recover assets. In August, law enforcement agencies succeeded in freezing about $9.2 million, but that is only a portion compared with the total damage. The more funds are dispersed across multiple addresses through mixers, the more complex the tracing work needed for further freezes and recovery could become.

Drift Protocol is also taking follow-up steps for victim compensation. On Oct. 1, it launched a compensation programme using the DFX token and also activated a buyback fund formed with support from Tether. But the funds raised so far are reported to cover only about 1 percent of users’ net losses.

The platform plans to use future revenue to replenish compensation funds. But hackers’ continued movement of stolen funds is increasing the likelihood that tracing and recovery will become difficult. With recovery potentially dragging on, whether remaining funds move further has emerged as a factor that could determine the chances of recovery.