@campuscodi I think it's a pretty common occurrence with crypto stuff. Sometimes it's really a white hat the indeed moved funds temporarily to protect them until a fix is deployed. Sometimes it's a black hat that intended to steal the funds, and then stroke a deal.
So, who knows.
