There are several possibilities. Here are four off the top of my head: (1) The "evil" had second thoughts and returned the money for one reason or another. I'm not sure why he'd return more than he stole since he was likely going to get away with it. (2) A white hat hacker took the money to force the CSS team to clean up their OPSEC and custody. He was always going to return it so once the message was relayed and the CSS community began a respond, he returned the funds. Why the extra 21 XMR? IMO, he was able to profit from the borrowing, possibly by taking advantage of the BTC pump (as his white hat hacker fee) and gave some of his gains back. (3) An insider "borrowed" the money, either for the white hacker reasons or take advantage of the BTC pump. The 21 XMR has the same meaning. (4) A BTC whale benefactor benefited from the pump but loves Monero and wants it not to suffer from the hack, so he gave his profits plus a 21 XMR hint.