In a surprising turn of events, the scammer responsible for the recent theft of over $71 million worth of wrapped Bitcoin (WBTC) has initiated the refund of a portion of the stolen funds to the victim.

The scammer, believed to have executed an “address poisoning” attack, stole 1,155 WBTC from the victim before selling the entire loot for 22,960 ETH. This ETH was then dispersed across multiple addresses, presumably for obfuscation and money laundering purposes.

Victim Receives ETH Refunds

Following the theft, the victim began receiving ETH transfers from the attacker, signaling a potential negotiation between the two parties. The attacker initially reached out to the victim via an on-chain message, requesting a Telegram address. Alongside this message, a transfer of 51 ETH ($152,000) was made.

Significant Return of Stolen Funds

Security firm PeckShield reports that the attacker has transferred a total of 11,446.87 ETH ($34.7 million) back to the victim’s address, constituting approximately 50% of the stolen funds. This unexpected development offers a glimmer of hope for the victim and underscores the complexity of cybercrime negotiations.

The identity of the Attacker Remains Elusive

Despite ongoing investigations, the identity and location of the hacker remain undisclosed. While SlowMist‘s threat intelligence network identified several IPs suspected to be associated with the hacker, originating from Hong Kong, the possibility of VPN usage complicates efforts to pinpoint the attacker’s true identity.

The saga of the $71 million WBTC theft and subsequent refund highlights the evolving landscape of cryptocurrency-related crimes and the challenges faced by security firms in tracking and apprehending cybercriminals.