According to BlockBeats, on November 28, according to Certik Alert monitoring, multiple deposits were detected in Tornado.Cash, which can be traced back to the $55 million phishing incident on August 21.
The attacker at the address starting with eth:0x5d4 has converted the minted DAI into ETH and dispersed the funds.