The attacker behind the $40 million GMX exploit has begun returning the stolen crypto after accepting a $5 million white hat bounty offered by the GMX team.