After the hacker returned the coins, he wrote another short essay: If he can find me within a month, I want to send him a gift

According to Babbitt News, at 23:40 on August 12, with the last transaction of 28,953 ETH on Ethereum being deposited into the Ethereum multi-signature payment address set by Poly Network, the previously stolen $610 million has been returned in full (580 million US dollars have been returned in full, of which 33.43 million USDT has been frozen by Tether), and the largest hacking incident in the history of blockchain, which lasted more than 50 hours, has come to a temporary end.

At 3:18 on August 13, the hacker left a message on the chain, expressing his apologies for the innocent people affected by his adventure:

Message hash address: 0x78b8d13618af4d1b8facfde5906cb40972ff70b04574de3aa6b2b403329c7b44

I try to avoid introducing any noise to the crypto world: no contact with shitcoins, no mass exchanges, no dumping of valuable assets. However, even the Avengers have to face endless lawsuits from civilians. Seriously, I am considering using limited bounties as a source of accidental victim compensation fund, but it is hard to prove that your loss is my fault, especially when you have gambled beyond your means. Another embarrassing fact is that refugees have taken over my mailing list, and it is hard to compete with them with your real story. Anyway, I will try to do something. The donation address is 0xA87fB85A93Ca072Cd4e5F0D4f178Bc831Df8a00B, and it will be the main source of the fund.

At 6:18 on August 13, the hacker left a message on the chain, explaining the background of the hacking incident to the community.

Transfer hash: 0xf34ee3551be7be57df6643d4ec7e4bdf9fd047d925c3c32a74e64e7428e5f8a9

Q: Why AMA? Your confession?

A: It's more like a journal. Something I'm proud of.

Q: Why return all the funds?

A: As I said, I don’t care about money or capital.

Q: Rubbish English?

A: English is not my first language (give away). I just expressed my true feelings without polishing. Typing while holding down the "Shift" key is not easy.

Q: Black hat or white hat?

A: I also enjoy judging others' superiority, but it is not easy. Not only can a legal person be a white hat, but a black hat person can also be a good person. People are changeable. Have you heard of gray?

Q: Shouldn’t white hats notify the developers?

A: Read P1Q1234. DEFI is a dark forest, hundreds of projects run away every year. I don’t trust anyone.

Q: Why do you hide in the dark?

A: Even if you are legal, you can be in danger for any reason. Security people do care about safety.

Q: Why do you need to explain so much?

A: Read P4Q2. The mentoring part means a lot to me. I want to share how I overcame my arrogance and greed. I think the mental challenge is no easier than the hacking part.
Honestly, I was so excited when EXPOLIT worked that I almost forgot about the original plan because there were so many guesses and it was unexpected (see P2Q1). The first message (see P3Q1) sparked my interest in doing something creative. I spent some time looking for interesting but reasonable ideas from my message list.
I was (still) very confident in my hiding, so I thought I could handle this game as long as I didn't cause unbearable losses. Later I began to calm down, because of those refugees. Yes, I realized that even temporarily taking over the money was still an unforgivable joke, it would cause too much pain.
For the "billion shitcoins" joke, I meant the headline was probably more eye-catching, but the outcome was the same: I'm not dumping shitcoins. That turned out to be a terrible joke. For the "DAO" joke, I asked the community how and when to refund. That was an irresponsible joke.
I am not scared at all by exposure or money laundering issues (read my rookie lessons). I just realized that I should be cautious because my decision will change many people's lives! If I leave the tokens there and quit the game, I can enjoy life as a millionaire and continue my quest as usual, but thousands of people will lose control of their own destiny. This goes against my personal philosophy (see P4Q2).
I once wrote an email to POLY with a signed ETH transaction from an anonymous email address. If they received the email, they would be able to broadcast transactions through my address. This was not a wise move because I could not broadcast any new messages before them. I guess that email must have been lost and I did not get a confirmation from ETH, but I waited for several hours because of this error.
The next part of the story is something you already know. I stopped playing and returned the money as I had planned.

Q: You were not exposed, but they had clues, so you were scared!

A: I am more confident than anyone else.
I am a well-known hacker in the real world (Identity Revealed 2). I work in the security industry and have devoted myself to the hacking profession since I was a child (Identity Revealed). Seriously, as security researchers, our job is to save the hidden world.
I know that security consulting is a tough job and that public relations and reputation mean a lot. I don't mind security teams making ads based on my incidents, especially when it helps them. Raising concerns about security is also the mission of our careers.
If any hacker can find my social identity within a month, I want to send him my personal gift. Otherwise, I may or may not reveal another clue of my identity. Shall we play a game?
Even though I was recognized, I still feel proud of my integrity :)