@banescusebi
One important example is the fact that funds are sometimes fully or partially returned by the hacker in exchange for a bounty or due to the fact that they hacker is doxxed by someone like Hypernative or Chainalysis to the authorities after a forensic investigation.