Wallets tied to the April 2026 exploit of Drift Protocol have resumed moving funds after roughly three months of dormancy, sending 23,095.1 ETH worth about $44.4 million into Tornado Cash and 0.85 ETH to wallets labeled as Bybit deposit addresses. Transfers began on July 23 and continued into July 24, with on-chain records showing repeated 100 ETH, 10 ETH and 1 ETH deposits into the mixer. Researcher JL, known as 0xJaelle, flagged the movement and tagged ZachXBT, who said he did not plan to keep tracking the funds without institutional support, describing the work required to monitor and potentially freeze a nine-figure North Korea-linked theft as beyond the capacity of one independent investigator. The movement covers only part of the original theft, which Drift valued in April at $295.7 million across JLP, USDC, Bitcoin-linked tokens, SOL, WETH and other assets. Drift has said it is working with law enforcement, Mandiant and blockchain intelligence firms, and had previously announced plans for a recovery bounty program with support from Arkham and Bybit, though key details of that program remained unclear. Drift’s June investigation update said Mandiant attributed the attack to UNC6862 and that the breach stemmed from social engineering and compromised operational access rather than a smart contract flaw, complicating recovery efforts as the trail becomes harder to follow.