More than $20 million worth of bridged Ether (ETH) has been mysteriously returned to blockchain-based gambling project ZKasino wallet — almost three weeks after users accused platform founders of an exit scam. 

On May 9, an X feed set up to recover funds from the ZKasino exit scam reported that almost $21 million worth of wstETH (wrapped Lido staking ETH) had returned to the project’s multisignature wallet — prompting some to believe investors may soon be getting their funds back as originally promised.

“One of the three scammers just sent the funds back to the original multi-sig wallet address,” the $JAIL feed said providing proof of the transfers with Etherscan.

The 6,021 wstETH moved equates to around two-thirds of the amount that went missing in the heist, prompting the question “Could they be preparing to refund the victims?”

ZKasino launched on April 20 offering an airdrop in its native token ZKAS to those that bridged ETH to the platform, promising to return the ETH.

However, the gambling project instead moved around $33 million worth of users’ bridged Ethereum to the staking protocol Lido Finance, instead of returning the funds to users as originally promised.

This led to accusations of an exit scam or rug pull as more than 10,000 people had bridged assets based on pledges made by the protocol that they claim was later broken.

On April 29, Dutch authorities arrested a 26-year-old man suspected of being involved in the alleged ZKasino scam.

Authorities seized around $12.2 million worth of cryptocurrencies, real estate, and luxury cars from the suspect at the time.

Some in the crypto community speculated the arrested suspect could be the project founder going under the pseudonym “Derivatives Monke” who was doxxed as Elham Nourzai by blockchain sleuths.

On May 8, Cointelegraph reported that the Binance on-chain investigations team played a key role in leading law enforcement to the arrest of the suspect.

Binance also assisted by freezing millions of dollars worth of stolen crypto after receiving a seizure warrant from authorities against the attacker’s accounts.

Despite the arrest, illicit funds continue moving on-chain, indicating other potential attackers may remain at large. However, the latest movement of funds back to the project’s multisig has renewed hope for victims.

Related: Trader loses $68M in address poisoning scam

April saw $25.7 million worth of cryptocurrency lost to scams and hacks, not including the ZKasino incident, according to figures from on-chain intelligence firm CertiK.

This is the lowest historical figure since 2021 according to the firm which started tracking the data that year.

Related: Lazarus Group laundered over $200M in hacked crypto since 2020