According to blockchain detective MistTrack, hackers who targeted Atomic Wallet for a $35 million heist in the first week of this month used cross-chain liquidation protocol THORChain as a way to hide their ill-gotten gain.

MistTrack reports that in the two days prior to the exchange, 503.08 ethers (ETH), which is around $870,000 connected to the hack, were transferred to THORChain.

MistTrack reported that some of the stolen ether had also been bridged using the Swft Blockchain to multiple bitcoin addresses.

The hackers transferred a portion of their stolen funds this week to the crypto exchange Garantex. Garantex was sanctioned last April by the Office of Foreign Assets Control of the U.S. Treasury.

Elliptic, a blockchain security company, believes that Lazarus is a North Korean hacking group.

THORChain’s native token (RUNE), which is a cryptocurrency, remains stable after a string of hacking-related transactions. It trades for 84 cents and has risen slightly over the last 24 hours, according to CoinMarketCap.

Parikshit Miishra is the editor.