Nearly all of the $600 million stolen in a huge crypto heist has been returned — but there’s a catch