There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.
Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner?
Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.
The original wallet is compromised so if you send the money back the attacker can immediately re-steal it. The original owner could try to out-RBF the attacker but game theoretically that leads to the money being converted to miner fees.
The underlying issue here is that addresses created by the tool at fault can have their private key derived from public data. If you send it back, it'll just get stolen again. Furthermore, the typical way that someone proves ownership of an address is by making a transaction from that address with parameters set via private communication with someone else. But since the private key is knowable, anyone can do that. There's no generic way to prove ownership of an address if the private key associated with that address can be determined by an attacker.
The STM32 in the ColdCard has a 96-bit UID "fused" at the factory. The lower 32 bits of this are seeded into the Yasmarang PRNG's initial state. Possession of a ColdCard with a UID matching a contested wallet might be able to serve as evidence of ownership.