Wrting was pretty good but the one thing i didnt understand is how team manage to get stolen funds back. Attacker is still not known, how funds gotten back if identity of the attacker still not known and team did not reach to attacker ? any one understand that ? @SeverMM any idea?

i guess they used the same function / vulnerability to 'steal' back the egld.

They did write in their article that "the attacker agreed to send other funds back" They HAD TO HAVE some sort of connection/contact to the attacker but they didn't know who it was!

Another part of the team is investigating solutions to recover the funds. In the meantime, most of the funds have been recovered from the attackers, but since this is still an open investigation, due to legal reasons, we will follow up with a more detailed overview as soon as the investigation is closed.