An address, marked as associated with the Unizen decentralized finance (DeFi) protocol hack, has funneled 865.4 Ether—worth around $2.16 million—into Tornado Cash, a notorious cryptocurrency mixing service.

On August 7, blockchain security firm PeckShield flagged this transaction, marking the first movement of the stolen funds since the hack occurred on March 8.

At the time of the breach, Unizen pledged to reimburse users who lost $750,000 or less, with refunds starting on March 11. Cointelegraph reached out to Unizen for comments on the ongoing situation but received no response prior to publication.

Read more: Crypto Hackers Exploit Ethereum Dip Using Pilfered Funds

Funds Funneled Through Tornado Cash

On August 7, the ill-gotten gains, including the Maker Protocol stablecoin Dai (DAI), began their exodus from the exploiter’s wallet for the first time since the Unizen hack, which occurred 151 days ago.

At 4:12 AM UTC, 500,000 DAI was dispatched, followed by an additional outflow of 1,679,859 DAI to an unknown wallet (0x8660…84d7).

By 4:14 AM, the exploiter commenced the conversion of 2,179,859 DAI into 863.67 Ether (ETH). Subsequently, the perpetrator began transferring the ETH to Tornado Cash through 26 discrete transactions starting at 5:35 AM.

Reimbursement of Stolen Funds

On March 11, Unizen announced that CEO Sean Noga had infused the company with funds to facilitate refunds to victims of the $2.16 million hack.

The announcement detailed that the refunded amounts would be provided in Tether (USDT) or USD Coin (USDC). For users whose losses exceeded $750,000, Unizen assured that these cases would be addressed individually.

Post-Hack Security Measures

Following the March exploit, Unizen’s Chief Technology Officer, Martin Granström, stated on X that the company was actively collaborating with third-party security firms and law enforcement to identify the hacker.

Granström further mentioned that the firm would release an incident report and increase future investments in security measures.