The return of the stolen funds indicates the perpetrator was not a nation-state actor