According to Ember Monitoring, after returning FRAX, the $GMX hacker began returning ETH: 3,000 $ETH was transferred back to the security committee multi-signature address mentioned by the $GMX team in the message 10 minutes ago by the hacker. [Foresight News]