Before the move, the hacker apparently refunded at least one victim, leading to a slew of on-chain messages from other purported victims.