There are several possibilities. Here are four off the top of my head: (1) The "evil" had second thoughts and returned the money for one reason or another. I'm not sure why he'd return more than he stole since he was likely going to get away with it. (2) A white hat hacker took the money to force the CSS team to clean up their OPSEC and custody. He was always going to return it so once the message was relayed and the CSS community began a respond, he returned the funds. Why the extra 21 XMR? IMO, he was able to profit from the borrowing, possibly by taking advantage of the BTC pump (as his white hat hacker fee) and gave some of his gains back. (3) An insider "borrowed" the money, either for the white hacker reasons or take advantage of the BTC pump. The 21 XMR has the same meaning. (4) A BTC whale benefactor benefited from the pump but loves Monero and wants it not to suffer from the hack, so he gave his profits plus a 21 XMR hint.

[–] [email protected] 2 points 11 months ago

I have three possibly theories about the "21".

The white hat is implying, “Windows 10? A nice OS. So you’re going to use Windows 11 soon? Well, this is what happens when you’re on Win 10 or 11.”
The white hat likes the digits 69, thinking it looks sexy.
There was a boat accident, and the hacker accidentally hit the wrong keys.