The funds were stolen in the largest DeFi hack to date on August 10. They were hijacked from Poly Network, which is a cross-chain protocol that lets crypto users swap tokens among blockchains. At this point, the only funds the hacker hasn't returned are the $33m in USDT that were frozen by Tether following the exploit. These can't be moved until Tether authorizes it but the company is working on it.