Wu said that he learned that Jason Brink, the former president of Gala, said in a tweet that the GALA attacker is suspected to have returned the stolen ETH. On-chain records show that the hacker address 0xe2...0F97 transferred 5913 ETH to 0xEC...9b4e at 20:43. The latter is the address with GALA contract management authority that was hacked by GALA.