According to Ember Monitoring, after returning FRAX, the GMX hacker began returning ETH: 3,000 ETH was transferred back to the security committee multi-signature address mentioned by the GMX team in the message 10 minutes ago by the hacker. [Foresight News]