A government-controlled wallet that had been drained of $20 million on Thursday received most of its funds back Friday, adding another layer of mystery to transactions flagged by blockchain analysts as likely being connected to a high-profile theft.

The pseudonymous blockchain sleuth ZachXBT had said in a tweet Thursday that the transfers resembled the playbook of a bad actor. Engaging with several decentralized finance protocols, the wallet had also tapped so-called instant exchanges after funds were moved across a series of transfers that “looked nefarious.”

About $19.3 million worth of funds had been returned to the wallet early Friday, per on-chain data collected by Arkham Intelligence, including Ethereum and the stablecoin USDC. Still, ZachXBT said in his Telegram community that funds transferred to exchanges had not yet been returned.

As of this writing, the government-controlled wallet was still missing around $1.2 million compared to what it had lost, according to Arkham’s analytics platform. Originally, the funds had been seized by the U.S. Department of Justice two years ago as connected to the infamous Bitfinex hack in 2016.

Editor's note: This story is breaking and will be updated with additional detail.