The Lazarus Group has been moving its spoils from the Harmony Bridge hack this weekend.

On Jan. 16, blockchain sleuth ‘ZachXBT’ posted details of the movements of large amounts of Ethereum. The crypto assets originated from the anonymizing service Tornado Cash and went through Railgun.

Railgun is a smart contract privacy platform that uses zero-knowledge proofs to obfuscate transactions.

Around 41,000 ETH worth roughly $63.5 million was sent through Railgun before being deposited on three different exchanges, according to the analyst who traced the movements through more than 350 addresses.