The attacker of the $611m Poly Network exploit has started returning the stolen crypto assets, less than a day after their ID information was reportedly obtained by blockchain security firm Slowmist.
About 20 minutes later, the team behind the Poly Network responded to the exploiter address through a transaction that it is "preparing a multi-sig address controlled by known Poly addresses." In a follow-up transaction, the Poly Network team identified three addresses that they hoped the attacker returns the funds to. The money is currently being sent to these addresses.
https://www.theblockcrypto.com/post/114189/poly-hack-attacker-return-funds-id-slowmist