The attacker behind India’s worst crypto hack has begun laundering some of the US$234 million stolen in the incident from the WazirX exchange, acting the same day the platform briefed on efforts to recover funds.

The perpetrator on Monday moved 2,500 ether tokens worth about US$6.3 million to Tornado Cash - a sanctioned service that blurs the origin of cryptoassets - soon after the briefing led by WazirX’s Dubai-based founder Nischal Shetty.

Blockchain intelligence firm Arkham Intelligence highlighted the flows, which underline the difficulty of recovering the digital assets. Over four million users have been impacted by a hack that threatens to erode confidence in domestic Indian crypto exchanges, which were already stunted by a transaction tax.

Details about the vulnerability in July’s incident and the attacker’s identity remain unconfirmed. Blockchain specialists Elliptic see a trail to hackers linked to North Korea, which uses cyberattacks to obtain foreign income.

“Some of the best researchers in the industry are telling that the pattern exactly matches” with a North Korean connection, Shetty said in the briefing, which also flagged that users are likely to see a maximum recovery of 57% of the crypto lost.

WazirX’s parent Zettai Pte has begun restructuring proceedings in Singapore. A two-year-old dispute with Binance, the world’s largest digital-asset exchange, about who actually owns WazirX all but rules out a white-knight investor.

Aggrieved customers in India have thronged social media to vent their frustration. At the same time, a record-breaking domestic stock market rally is grabbing the investment spotlight.

  - Bloomberg