Gala Games has received around $22 million in Ether (ETH) from the person responsible for a May 20 “security incident” where $200 million worth of Gala (GALA) tokens were minted and a small portion sold before the wallet was frozen.

On May 21, the attacker’s wallet sent back 5913.2 ETH worth $22.3 million — close to the market value of the 600 million GALA they sold a day earlier.

Gala said in a May 21 blog post that the ETH’s return came after the team’s “swift, effective response and the involvement of Federal law enforcement agencies.”

Gala said it used a new “GalaChain’s blocklist protocol” feature to effectively freeze 4.4 billion GALA from the 5 billion minted within 45 minutes. 

Gala’s co-founder and CEO, Eric Schiermeyer, said in a May 20 X and Discord post that the alleged attacker had been identified, including “his home address.”

Gala Games has not publicly confirmed the identity or method of the exploit, but some community members claim Gala had said the attack was from a security contractor who slipped up after connecting to the wallet without a VPN.

Schiermeyer said in a Discord post that the team will likely buy back and burn the equivalent GALA tokens using the returned ETH.

“I don’t see anything else we should do with the eth,” Schiermeyer wrote. “We will probably buy and burn on galaswap.”

Meanwhile, a Gala Games blog post suggested a governance vote is being conducted to decide if the 4.4 billion blocklisted GALA will be “considered burned.”

Related: Gala Games CEO blames $23M exploit on ‘messed up’ internal controls

The string of developments comes as DWF Labs revealed it purchased 28 million GALA tokens in the open market to “stabilize the token’s value.”

“The security of our investments and their communities is important to us,” said the firm.

GALA is up 0.4% in 24 hours to $0.043 — up 9.3% over the last seven days, according to CoinGecko.

Magazine: The $2,500 doco about FTX collapse on Amazon Prime… with help from mom