The good phisher: How a USDT holder lost and recovered $129m within hours