Curve ultimatum to hacker expires in 10 hours: return stolen funds or face $1.9MM bounty for identification leading to conviction