Also, the coins of the hack are still sitting in several wallets, which may indicate that there could be a slight chance that the hacker will return it.
i can only think of one reason why the hacker would return those coins, manipulating the shit out of the market
you steal some major amount of coins ==> instigate a panic sell, you buy now cheap and return the coins stolen, repeat for other exchange
but unless someone is making big profit with this, it would be better to not return anything