I'm guessing the difference was the split of the 75 between different affiliates of the hackers. Maybe the initial hackers get X and the ransomware people get Y, and X+Y = 75. They only recovered one side of that transaction.