The attacker still holds 598.50 Bitcoin after returning about 3,400 of nearly 4,000 Bitcoin taken during the Sept. 6 exploit.