Yeah, It is very strange. In fact, it is the first time I heard a hacker return the funds, I guess there is so many scenarios behind it and we don't know. Maybe someone hired a hacker just to test their platform on how good is the website security, all we can do is speculate. Well, everything that comes to the computer and programming and stuff can be penetrated by humans because it was made by a human so its possible that the hacker made a mistake and lead it right back at him. It is a good thing that all funds are returned.
There is nothing much to speculate as the hacker knew that the authorities had all his information to get him behind bars, the hacker forwarded the heist because he knew that his IP address is exposed because he messed up trying to cash out the funds through a centralized exchange without hiding his IP and now his IP address is submitted to the Singapore police and so is the reason we are hearing for the first time that a hacker returned the funds.