CrossCurve calls for several addresses who have received funds from the exploit, which they view as probably not malicious, to return funds