It looks like the Hacker got around $18mil and the WhiteHats got $81mil.
MultisigExploit-Hacker:
https://etherscan.io/address/0xb3764761e297d6f121e79c32a65829cd1ddb4d32
MultisigExploit-WhiteHat:
https://etherscan.io/address/0x1dba1131000664b884a1ba238464159892252d3a
It actually was about $30mil obtained by the hacker. I was just looking at the balance and hadn't accounted for several 10k ETH outflows from the hacker's address.