After fraudulently creating $6.7 million in stablecoins, the attackers failed to liquidate the assets — and now claim the whole thing was a pen test