The hacker that drained $25 million in cryptocurrency from decentralized finance protocol dForce over the weekend has sent back almost all the stolen assets.

According to data visible on the Ethereum blockchain, multiple transactions were initiated from 6:00 UTC on Tuesday from an address labelled “Lendf.Me Hack” to the admin address for the Lendf.Me project.

The transactions included some extremely large amounts, such as one for 57,992 ether (ETH), the native cryptocurrency of the Ethereum blockchain – an amount worth around $10 million at press time.

Additional transactions involved various U.S. dollar-linked stablecoins – such as USDT, BUSD, TUSD, DAI, USDC, HUSD and PAX – totaling nearly $10 million.

Further, a total of 581 units of WBTC, HBTC and imBTC – ethereum tokens that peg to bitcoin as an underlying collateral – have also been returned. The sum of these is worth around $4 million at bitcoin’s current price.

Curiously, the hacker did not return exactly the same balance of assets as were stolen, but returned some of the value in other types of tokens. All told, however, they handed back crypto assets worth roughly $24 million as of press time.

It’s unknown at this stage why the hacker didn’t simply return the assets that were stolen, or indeed why they were returned at all.

Lendf is one of two protocols supported by the dForce Foundation. It saw $25 million in cryptocurrencies exit its wallets over three hours on Sunday morning Asia time.