The $8.4 million has been funneled through Tornado Cash, while Bunni offers 10% of the stolen funds if the attacker returns the remainder.