It might be better to assume that it's entirely the attacker's money until at least one actual victim steps forward.