About $295.4 million in user funds was stolen in the April 1 hack, with the attacker identified as North Korea-linked threat group UNC6862. The Drift Foundation said Mandiant, zeroShadow and SEAL 911 investigated the incident and traced the funds after they were bridged to Ethereum. About 130,259 ETH was held across four wallets, including 107,165 ETH in three wallets that has not moved. The remaining 23,094 ETH was sent to Tornado Cash, a crypto mixer designed to obscure transaction links, on July 23. About $9.2 million has been frozen. The foundation is working with law enforcement agencies and zeroShadow to monitor related wallets and fund movements, with recovered assets planned for transfer to the DFX recovery pool.