It is an op-return included with a transaction moving the stolen funds. Isn't that evidence enough of who sent it? Or am I missing something here?