In reality, parts of the crypto community moved quickly to block transactions involving the funds and some security researchers claimed they had solid leads on tracking down the hacker’s identity. I think the hacker realized that if their identity was compromised then the legal system wouldn’t look kindly on someone stealing hundreds of millions of dollars.
Returning the funds and trying to portray the hack as a noble operation to identify flaws in the system is one way to try to re-spin the events as a positive. It appears they’re hoping to collect donations or some sort of reward as a sort of clean money takeaway.
It must have been a wild emotional roller coaster to go from securing $600 million dollars for yourself to realizing that you made a mistake that tied your real identity to the heist.