A hacker who previously exploited the GMX platform has started returning the stolen funds. Approximately 5.49 million FRAX tokens have been transferred back to the GMX deployer address. The majority of the funds are currently on the Ethereum mainnet, with further returns expected. The hacker's decision to return the funds suggests a shift towards acting as a white-hat hacker, possibly due to concerns over being identified.